{"id":"CVE-2026-99208","kind":"vulnerability","aliases":["CVE-2026-99208"],"related":[],"title":"Linux kernel: Intel Xe OA buffer can leak stale kernel memory to userspace","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/oa: Zero OA buffer at allocation\n\nttm_bo_type_kernel BOs are not guaranteed to be zeroed on allocation and\nmay contain data from previously freed pages. Since the OA buffer is\nmmap'able by userspace, this can expose stale kernel memory contents.\n\nStreams opened with DRM_XE_OA_PROPERTY_OA_DISABLED allocate the OA\nbuffer without calling xe_oa_init_oa_buffer(). Zero the buffer at\nallocation to prevent information disclosure through mmap.\n\nThe existing zeroing in xe_oa_init_oa_buffer() remains necessary for\nzero report-id/timestamp detection on enable/re-enable.\n\n(cherry picked from commit 126c4c5388f9311a390b9b254a835b0cf0f55331)","summary":"The Intel Xe graphics driver in the Linux kernel allocated the observation (OA) buffer without zeroing it, and that buffer can be mapped by userspace. A local process could read leftover contents of previously freed kernel pages through that mapping.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["intel-xe","linux-kernel","package","self-hosted"],"not_affected_if":["default-config","no-intel-xe-gpu"],"how_to_check":"- unknown","fix":"- Update to a Linux kernel release that includes upstream commit 126c4c5388f9311a390b9b254a835b0cf0f55331 (drm/xe/oa: Zero OA buffer at allocation); the sources do not name the fixed version numbers.","status":"open","published_at":"2026-10-28T11:17:42+00:00","first_seen_at":"2026-10-28T11:32:37+00:00","triaged_at":"2026-10-28T11:33:53+00:00","updated_at":"2026-10-28T11:33:53+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T11:33:53Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes upstream commit 126c4c5388f9311a390b9b254a835b0cf0f55331 (drm/xe/oa: Zero OA buffer at allocation); the sources do not name the fixed version numbers.","reach":"local","title":"Linux kernel: Intel Xe OA buffer can leak stale kernel memory to userspace","impact":"low","summary":"The Intel Xe graphics driver in the Linux kernel allocated the observation (OA) buffer without zeroing it, and that buffer can be mapped by userspace. A local process could read leftover contents of previously freed kernel pages through that mapping.","category":"package","nicknames":[],"who_cares":["linux-kernel","intel-xe","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"local user reads stale kernel memory contents via mmap","analyst_note":"Confirm affected kernel version ranges and fixed release numbers from the NVD entry or the kernel stable git log for commit 126c4c5388f9311a390b9b254a835b0cf0f55331.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-intel-xe-gpu","default-config"],"who_is_affected":"Systems running a Linux kernel with the Intel Xe DRM driver and the OA (performance monitoring) interface in use, where streams are opened with the OA_DISABLED property. Systems without Intel Xe graphics hardware or without this driver loaded are unlikely to be exposed. The sources do not say which kernel versions are affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000646,"input_tokens":3517,"output_tokens":588,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-99208':16A,19A '/timestamp':170C '126c4c5388f9311a390b9b254a835b0cf0f55331':178C 'abl':113C 'alloc':39B,85C,98C,132C,147C 'bo':87C 'bos':90C 'buffer':6A,43B,49B,83C,110C,135C,142C,145C,162C 'call':137C 'cherri':174C 'commit':177C 'contain':101C 'content':61B,122C 'could':58B 'cve':14A,17A 'data':102C 'detect':171C 'disabl':131C 'disclosur':151C 'driver':34B 'drm':126C 'drm/xe/oa':80C 'enable/re-enable':173C 'exist':155C 'expos':118C 'follow':75C 'freed':64B,105C 'graphic':33B 'guarante':93C 'host':29B 'id':169C 'inform':150C 'init':140C,160C 'intel':3A,21B,31B 'intel-x':20B 'kernel':2A,10A,25B,38B,65B,73C,89C,120C 'leak':8A 'leftov':60B 'linux':1A,24B,37B,72C 'linux-kernel':23B 'local':56B 'map':52B,69B 'may':100C 'memori':11A,121C 'mmap':112C,153C 'necessari':164C 'oa':5A,42B,82C,109C,128C,130C,134C,139C,141C,159C,161C 'observ':41B 'open':124C 'packag':26B 'page':66B,106C 'pick':175C 'prevent':149C 'previous':63B,104C 'process':57B 'properti':129C 'read':59B 'remain':163C 'report':168C 'report-id':167C 'resolv':79C 'self':28B 'self-host':27B 'sinc':107C 'stale':9A,119C 'stream':123C 'ttm':86C 'type':88C 'userspac':13A,54B,115C 'vulner':76C 'without':44B,136C 'xe':4A,22B,32B,127C,138C,158C 'zero':45B,81C,96C,143C,156C,166C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the Intel Xe DRM driver and the OA (performance monitoring) interface in use, where streams are opened with the OA_DISABLED property. Systems without Intel Xe graphics hardware or without this driver loaded are unlikely to be exposed. The sources do not say which kernel versions are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:42+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99208","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99208","severity":null,"published_at":"2026-10-28T11:17:42+00:00","modified_at":"2026-10-28T11:17:42+00:00","first_seen_at":"2026-10-28T11:32:37+00:00","fetched_at":"2026-10-28T11:32:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}