CVE-2026-80903

What it actually does

The xe_oa_emit_oa_config function leaks sync entries and the syncs array on failure paths before the point of no return (fence allocation, config buffer allocation or batch submission), leaving references unreachable after subsequent config ioctls overwrite stream->syncs.

Why it matters to the business

Repeated triggering on systems using Intel Xe graphics can gradually deplete kernel memory, leading to performance degradation, instability, or denial of service over time.

How an attack unfolds

A local attacker invokes OA configuration ioctls that intentionally fail at allocation points inside xe_oa_emit_oa_config, causing the leak; repeated operations exhaust memory while the stream open error path and later overwrites prevent cleanup.

How to fix it

Apply the upstream fix that adds cleanup of parsed syncs on xe_oa_emit_oa_config failure, matching the stream open error path; rebuild and deploy the patched kernel.

How to confirm the fix worked

Inspect the xe_oa_emit_oa_config implementation to confirm error paths release sync entries and the syncs array before returning; verify the change appears in the running kernel source or binary.

Typical attack path

1. Gain local user access on an affected Linux system
2. Trigger repeated OA config emit operations engineered to fail before the success path
3. Observe progressive kernel memory consumption without corresponding process growth

How to detect it

Examine kernel logs for drm/xe/oa errors around config emit failures and use slab or kmemleak tools to identify unreleased sync objects; correlate with processes performing frequent OA config ioctls.

What your security team should do

• Prioritize kernel updates for systems with Intel Xe hardware and active graphics workloads
• Monitor kernel memory statistics for unexplained growth correlated with drm/xe activity
• Limit untrusted local access until patches are deployed