Live › vulnerability › CVE-2026-99208
Go to dashboardThe Intel Xe graphics driver in the Linux kernel allocated the observation (OA) buffer without zeroing it, and that buffer can be mapped by userspace. A local process could read leftover contents of previously freed kernel pages through that mapping.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 11:32 UTC. All times on this page are UTC.
Systems running a Linux kernel with the Intel Xe DRM driver and the OA (performance monitoring) interface in use, where streams are opened with the OA_DISABLED property. Systems without Intel Xe graphics hardware or without this driver loaded are unlikely to be exposed. The sources do not say which kernel versions are affected.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
drm/xe/oa: Zero OA buffer at allocation
ttm_bo_type_kernel BOs are not guaranteed to be zeroed on allocation and may contain data from previously freed pages. Since the OA buffer is mmap'able by userspace, this can expose stale kernel memory contents.
Streams opened with DRM_XE_OA_PROPERTY_OA_DISABLED allocate the OA buffer without calling xe_oa_init_oa_buffer(). Zero the buffer at allocation to prevent information disclosure through mmap.
The existing zeroing in xe_oa_init_oa_buffer() remains necessary for zero report-id/timestamp detection on enable/re-enable.
(cherry picked from commit 126c4c5388f9311a390b9b254a835b0cf0f55331)
This page as .md · .json · in your agent: get_signal("CVE-2026-99208")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.