CVE-2024-26985

What it actually does

Reference leak of a buffer object (BO) in the error path of intel_fb_bo_framebuffer_init in the Linux kernel DRM/XE driver, causing a memory leak on failure.

Why it matters to the business

Over time, repeated triggering of the error path in graphics initialization on affected Linux systems can lead to gradual resource exhaustion, potential instability, or degraded performance in environments relying on the kernel's display subsystem.

How an attack unfolds

An attacker with local access triggers framebuffer initialization errors repeatedly through crafted graphics or display operations, exhausting kernel memory resources without triggering the reference release.

How to fix it

Update the Linux kernel to a version containing commit 7d8ac0942c312abda43b407eff72d31747a7b472 (or later stable equivalents) for the org/pub/scm/linux/kernel/git/stable/linux.git tree; apply equivalent fixes for any downstream distributions.

How to confirm the fix worked

Confirm the kernel source contains the unreference call in the error path of intel_fb_bo_framebuffer_init and returns 0 on success; verify no BO leaks via kmemleak or similar after exercising framebuffer init error paths.

Typical attack path

1. Obtain local access on a system running an affected kernel version.
2. Trigger error conditions in DRM framebuffer initialization via userspace graphics APIs or display configuration changes.
3. Repeat to accumulate leaked BO references and exhaust memory.

How to detect it

Search kernel logs and memory debug output for repeated framebuffer initialization failures without corresponding BO releases; use memory leak detectors on systems running vulnerable kernels.

What your security team should do

• Prioritize kernel updates on systems using the XE DRM driver.
• Monitor for memory pressure indicators on graphics workloads.
• Review graphics driver error paths in custom or embedded kernels.