CVE-2024-53087

What it actually does

Reference count leak on error paths in the exec IOCTL after looking up an exec queue, allowing the queue object to remain referenced indefinitely.

Why it matters to the business

Kernel memory exhaustion over time on systems performing repeated graphics submission operations that hit input validation errors, potentially leading to denial of service or degraded performance in graphics workloads.

How an attack unfolds

An attacker crafts malicious or malformed input to the exec IOCTL that triggers early returns after an exec queue lookup but before the reference is released, gradually leaking kernel objects until resource limits are reached or secondary corruption occurs.

How to fix it

Update to a kernel containing commit 07064a200b40ac2195cb6b7b779897d9377e5e6f or any later stable release that ensures the exec queue reference is always released on input errors in the exec IOCTL path.

How to confirm the fix worked

Confirm the presence of the reference drop on all early return paths in the exec IOCTL by code review or by applying the patch and verifying no new warnings or leaks under error-injection testing.

Typical attack path

1. Identify or trigger repeated calls to the exec IOCTL with invalid parameters after a valid queue lookup.
2. Force error paths that return without dropping the acquired reference.
3. Repeat to accumulate unreleased objects and exhaust kernel memory.
4. Optionally combine with other operations to convert the leak into use-after-free or other corruption.

How to detect it

Review kernel logs for repeated exec IOCTL error paths, monitor slab or kmemleak reports for growing drm_xe_exec_queue objects, and correlate with application-level graphics submission failures.

What your security team should do

• Prioritize kernel updates on systems exposing the Xe DRM driver to untrusted users or workloads.
• Monitor for unusual growth in kernel memory usage correlated with graphics submission activity.
• Apply defense-in-depth by restricting access to the DRM device nodes where feasible.