Log in Start free

Vulnerability · Published Jun 8, 2026 · Assigned by Linux

CVE-2026-46309drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise

High 7.0

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.0High
Exploit odds (30 days)0.1%top 97.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise Add validation in xe_vm_madvise_ioctl() to reject PAT indices with XE_COH_NONE coherency mode when applied to CPU cached memory. Using coh_none with CPU cached buffers is a security issue. When the kernel clears pages before reallocation, the clear operation stays in CPU cache (dirty). GPU with coh_none can bypass CPU caches and read stale sensitive data directly from DRAM, potentially leaking data from previously freed pages of other processes. This aligns with the existing validation in vm_bind path (xe_vm_bind_ioctl_validate_bo). v2(Matthew brost) - Add fixes - Move one debug print to better place v3(Matthew Auld) - Should be drm/xe/uapi - More Cc v4(Shuicheng Lin) - Fix kmem leak issues by the way v5 - Remove kmem leak because it has been merged by another patch v6 - Remove the fix which is not related to current fix v7 - No change v8 - Rebase v9 - Limit the restrictions to iGPU v10 - No change (cherry picked from commit 016ccdb674b8c899940b3944952c96a6a490d10a)

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:9kernel5.14.0-687.57.1.el9_8ALSA-2026:81552
AlmaLinux:9kernel-64k5.14.0-687.57.1.el9_8ALSA-2026:81552
AlmaLinux:9kernel-64k-core5.14.0-687.57.1.el9_8ALSA-2026:81552
AlmaLinux:9kernel-64k-debug5.14.0-687.57.1.el9_8ALSA-2026:81552
AlmaLinux:9kernel-64k-debug-core5.14.0-687.57.1.el9_8ALSA-2026:81552
AlmaLinux:9kernel-64k-debug-modules5.14.0-687.57.1.el9_8ALSA-2026:81552
AlmaLinux:9kernel-64k-debug-modules-core5.14.0-687.57.1.el9_8ALSA-2026:81552
AlmaLinux:9kernel-64k-debug-modules-extra5.14.0-687.57.1.el9_8ALSA-2026:81552
AlmaLinux:9kernel-64k-modules5.14.0-687.57.1.el9_8ALSA-2026:81552
AlmaLinux:9kernel-64k-modules-core5.14.0-687.57.1.el9_8ALSA-2026:81552
AlmaLinux:9kernel-64k-modules-extra5.14.0-687.57.1.el9_8ALSA-2026:81552
AlmaLinux:9kernel-abi-stablelists5.14.0-687.57.1.el9_8ALSA-2026:81552
AlmaLinux:9kernel-core5.14.0-687.57.1.el9_8ALSA-2026:81552
AlmaLinux:9kernel-debug5.14.0-687.57.1.el9_8ALSA-2026:81552
AlmaLinux:9kernel-debug-core5.14.0-687.57.1.el9_8ALSA-2026:81552
AlmaLinux:9kernel-debug-modules5.14.0-687.57.1.el9_8ALSA-2026:81552
AlmaLinux:9kernel-debug-modules-core5.14.0-687.57.1.el9_8ALSA-2026:81552
AlmaLinux:9kernel-debug-modules-extra5.14.0-687.57.1.el9_8ALSA-2026:81552
Debian:14linux7.0.9-1DEBIAN-CVE-2026-46309
Rocky Linux:9kernel0:5.14.0-687.57.1.el9_8RLSA-2026:81552
Ubuntu:26.04:LTSlinux7.0.0-28.28UBUNTU-CVE-2026-46309
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2026-46309
Ubuntu:26.04:LTSlinux-aws7.0.0-1009.9UBUNTU-CVE-2026-46309
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2026-46309
Ubuntu:24.04:LTSlinux-aws-6.14no fix listedUBUNTU-CVE-2026-46309
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2026-46309
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2026-46309
Ubuntu:26.04:LTSlinux-azure7.0.0-1010.10UBUNTU-CVE-2026-46309
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2026-46309
Ubuntu:24.04:LTSlinux-azure-6.11no fix listedUBUNTU-CVE-2026-46309
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2026-46309
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2026-46309
Ubuntu:24.04:LTSlinux-azure-7.07.0.0-1014.14~24.04.1UBUNTU-CVE-2026-46309
Ubuntu:26.04:LTSlinux-azure-fde7.0.0-1009.9UBUNTU-CVE-2026-46309
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2026-46309
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2026-46309
Ubuntu:24.04:LTSlinux-azure-fde-7.07.0.0-1013.13~24.04.1UBUNTU-CVE-2026-46309
Ubuntu:26.04:LTSlinux-gcp7.0.0-1008.8UBUNTU-CVE-2026-46309
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2026-46309
Ubuntu:24.04:LTSlinux-gcp-6.11no fix listedUBUNTU-CVE-2026-46309
Ubuntu:24.04:LTSlinux-gcp-6.14no fix listedUBUNTU-CVE-2026-46309
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2026-46309
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2026-46309
Ubuntu:24.04:LTSlinux-gcp-7.07.0.0-1011.11~24.04.1UBUNTU-CVE-2026-46309
Ubuntu:26.04:LTSlinux-gke7.0.0-1003.4UBUNTU-CVE-2026-46309
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2026-46309
Ubuntu:24.04:LTSlinux-hwe-6.11no fix listedUBUNTU-CVE-2026-46309
Ubuntu:24.04:LTSlinux-hwe-6.14no fix listedUBUNTU-CVE-2026-46309
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2026-46309
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2026-46309
Ubuntu:24.04:LTSlinux-hwe-7.07.0.0-28.28~24.04.1UBUNTU-CVE-2026-46309
Ubuntu:26.04:LTSlinux-ibm7.0.0-1010.10UBUNTU-CVE-2026-46309
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2026-46309
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2026-46309
Ubuntu:24.04:LTSlinux-lowlatency-hwe-6.11no fix listedUBUNTU-CVE-2026-46309
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2026-46309
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2026-46309
Ubuntu:26.04:LTSlinux-nvidia7.0.0-1016.16UBUNTU-CVE-2026-46309
Ubuntu:24.04:LTSlinux-nvidia-6.11no fix listedUBUNTU-CVE-2026-46309
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2026-46309
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2026-46309
Ubuntu:24.04:LTSlinux-nvidia-7.07.0.0-1016.16~24.04.1UBUNTU-CVE-2026-46309
Ubuntu:26.04:LTSlinux-nvidia-bos7.0.0-2016.16UBUNTU-CVE-2026-46309
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2026-46309
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2026-46309
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2026-46309
Ubuntu:24.04:LTSlinux-oem-6.11no fix listedUBUNTU-CVE-2026-46309
Ubuntu:24.04:LTSlinux-oem-6.14no fix listedUBUNTU-CVE-2026-46309
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2026-46309
Ubuntu:24.04:LTSlinux-oem-6.8no fix listedUBUNTU-CVE-2026-46309
Ubuntu:26.04:LTSlinux-oem-7.07.0.0-1009.9UBUNTU-CVE-2026-46309
Ubuntu:26.04:LTSlinux-oracle7.0.0-1008.8UBUNTU-CVE-2026-46309
Ubuntu:24.04:LTSlinux-oracle-6.14no fix listedUBUNTU-CVE-2026-46309
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2026-46309
Ubuntu:24.04:LTSlinux-oracle-7.07.0.0-1011.11~24.04.1UBUNTU-CVE-2026-46309
Ubuntu:26.04:LTSlinux-raspi7.0.0-1015.15UBUNTU-CVE-2026-46309
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2026-46309
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-46309
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-46309
Ubuntu:26.04:LTSlinux-realtime7.0.0-28.28.1UBUNTU-CVE-2026-46309
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2026-46309
Ubuntu:24.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2026-46309
Ubuntu:26.04:LTSlinux-riscv7.0.0-28.28.1UBUNTU-CVE-2026-46309
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2026-46309
Ubuntu:24.04:LTSlinux-riscv-6.14no fix listedUBUNTU-CVE-2026-46309
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2026-46309
Ubuntu:24.04:LTSlinux-riscv-7.07.0.0-28.28.1~24.04.3UBUNTU-CVE-2026-46309
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2026-46309
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2026-46309
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2026-46309

Affected products (as reported)

VendorProductVersions
Linux Linux ada7486c5668db542a7d361268df931aca5b726a – before 87f9b1528e1ffc1da3615d552c9a06aba5e20b00ada7486c5668db542a7d361268df931aca5b726a – before fea04cf6f2345bc50f15b6638906c35962b89424ada7486c5668db542a7d361268df931aca5b726a – before 4e5591c2fc1b30f4ea5e2eab4c3a695acc404e39
Linux Linux 6.18

Weakness: CWE-524 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References