Use-After-Free Vulnerability in Linux Kernel Affecting Device Structures

CVE-2026-53290

What is CVE-2026-53290?

A vulnerability in the Linux kernel was identified where the function drm_dev_put() was called prematurely in xe_eu_stall_stream_close(). This misordering could lead to a use-after-free situation where device structures were improperly accessed after being freed. The issue arises when the last reference to these device structures is dropped before ensuring all resources are properly cleaned up, potentially leading to a crash or erratic behavior. The fix involved moving the drm_dev_put() call to occur after all device accesses are completed, ensuring proper resource management and stability in system operations.

References