---
id: CVE-2026-46201
title: 'drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import()

  When xe_dma_buf_init_obj() fails, the attachment from
  dma_buf_dynamic_attach() is not detached. Add dma_bu…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= dd08ebf6c3525a7ea2186e636df064ea47281987 <
    d394669e194936d7ce15284a24a5ae334c4c5b74
  - >-
    Linux >= dd08ebf6c3525a7ea2186e636df064ea47281987 <
    0afa8b1ef582ecf6fb04097fd356f8741e5005ed
  - >-
    Linux >= dd08ebf6c3525a7ea2186e636df064ea47281987 <
    eea1e10f8d99c0f04deef707c99705b94bba3b78
  - >-
    Linux >= dd08ebf6c3525a7ea2186e636df064ea47281987 <
    111ab678471bf1f90d078d5513bb086b70596c3c
  - Linux 6.8
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:21:05.797214Z'
published: '2026-05-28'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:31:07.817Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-46201'
references:
  - url: 'https://git.kernel.org/stable/c/d394669e194936d7ce15284a24a5ae334c4c5b74'
  - url: 'https://git.kernel.org/stable/c/0afa8b1ef582ecf6fb04097fd356f8741e5005ed'
  - url: 'https://git.kernel.org/stable/c/eea1e10f8d99c0f04deef707c99705b94bba3b78'
  - url: 'https://git.kernel.org/stable/c/111ab678471bf1f90d078d5513bb086b70596c3c'
tags:
  - cve.org
epss: 0.00175
epssPercentile: 0.06542
ingestedAt: '2026-10-16T17:24:46.712Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import()

When xe_dma_buf_init_obj() fails, the attachment from
dma_buf_dynamic_attach() is not detached. Add dma_buf_detach() before
returning the error. Note: we cannot use goto out_err here because
xe_dma_buf_init_obj() already frees bo on failure, and out_err would
double-free it.

(cherry picked from commit a828eb185aac41800df8eae4b60501ccc0dbbe51)

## Affected

- `Linux >= dd08ebf6c3525a7ea2186e636df064ea47281987 < d394669e194936d7ce15284a24a5ae334c4c5b74`
- `Linux >= dd08ebf6c3525a7ea2186e636df064ea47281987 < 0afa8b1ef582ecf6fb04097fd356f8741e5005ed`
- `Linux >= dd08ebf6c3525a7ea2186e636df064ea47281987 < eea1e10f8d99c0f04deef707c99705b94bba3b78`
- `Linux >= dd08ebf6c3525a7ea2186e636df064ea47281987 < 111ab678471bf1f90d078d5513bb086b70596c3c`
- `Linux 6.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.