CVE-2026-68244

What it actually does

Memory leak of the siblings[] array allocated during successful BALANCE/PARALLEL_SUBMIT context extensions when a subsequent user extension fails during proto-context processing in the i915 GEM driver.

Why it matters to the business

Repeated triggering can cause gradual kernel memory exhaustion on systems using Intel graphics, potentially leading to reduced performance, instability, or denial of service over time in graphics-intensive workloads.

How an attack unfolds

An attacker with local access crafts a sequence of DRM context creation ioctls that succeed on the first extension but fail on a later one, repeatedly leaking small kernel allocations until memory pressure impacts the system.

How to fix it

Update to a Linux kernel containing commit aa65e0a4b51b3b54b53e4142aaa2d997aa1061ff or the equivalent backport that clears siblings[] on proto-context error paths.

How to confirm the fix worked

Inspect drm/i915/gem/i915_gem_context.c for the corrected error handling after extension processing; confirm the siblings[] array is freed on all error paths before the context is finalized.

Typical attack path

1. Obtain local unprivileged access on a Linux system with i915 hardware
2. Open a DRM device and issue context creation with BALANCE or PARALLEL_SUBMIT extension
3. Follow immediately with a malformed or failing subsequent extension to trigger the error path
4. Repeat the pattern in a loop to amplify the leak

How to detect it

Review kernel logs for repeated i915 context creation failures accompanied by rising slab or kmalloc memory usage; correlate with processes issuing DRM_IOCTL_I915_GEM_CONTEXT_CREATE_EXT.

What your security team should do

• Prioritize kernel updates on systems exposing Intel i915 GPUs to untrusted local users
• Monitor kernel memory usage and OOM events on graphics workloads
• Restrict unprivileged access to /dev/dri/renderD* nodes where feasible