CVE-2026-52950

Last refreshed2026-10-17

Status: UPDATED | Advisory ID: CVE-2026-52950

Key Details

CVE	CVE-2026-52950
CVSS Score / Version	7.8 (High) / CVSS v3.1
Updated	2026-10-16
CVSS Vector	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is local; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel, Red Hat Enterprise Linux 10, and Red Hat Enterprise Linux 9
Classified as	CWE-416 (Use After Free)

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel
Red Hat	Red Hat Enterprise Linux 10
Red Hat	Red Hat Enterprise Linux 9

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Red Hat

Red Hat Enterprise Linux 10

Red Hat

Red Hat Enterprise Linux 9

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/dma-buf: fix UAF with retry loop

Retry doesn't work here, since bo will be freed on error, leading to

UAF. However, now that we do the alloc & init before the attach, we can

now combine this as one unit and have the init do the alloc for us. This

should make the retry safe.

Reported by Sashiko.

v2: Fix up the error unwind (CI)

(cherry picked from commit 479669418253e0f27f8cf5db01a731352ea592e7) (NVD)

Monitor Linux's and Red Hat's web pages for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-52950
CVE	https://www.cve.org/CVERecord?id=CVE-2026-52950

Source

Reference

NVD

CVE