Cloudanix VulnDB

CVE-2026-99208

None

CVSS

—

EPSS

0.2%

Published

Oct 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A graphics driver bug in Linux could let ordinary programs see leftover pieces of internal operating system memory that should have stayed hidden.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Data Exposure
Component
OS kernel
Class
Information Disclosure
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The OA buffer allocated as ttm_bo_type_kernel is not zeroed, allowing userspace mmap to read residual data from previously freed kernel pages.

Why it matters to the business

Local users could obtain fragments of kernel memory, raising the risk of sensitive data exposure or aiding further system compromise.

How an attack unfolds

An attacker with local access opens an OA stream using the OA_DISABLED property, maps the buffer, and reads uninitialized pages that may contain prior kernel contents.

How to fix it

Apply the upstream fix that zeros the OA buffer at allocation time (cherry-picked from commit 126c4c5388f9311a390b9b254a835b0cf0f55331) or upgrade to a kernel containing the resolution.

How to confirm the fix worked

Confirm the zeroing call exists at OA buffer allocation in the xe driver before any mmap exposure, and test that newly allocated buffers contain only zeros.

Typical attack path

  1. Gain local unprivileged access on a Linux system
  2. Open DRM_XE_OA stream with DRM_XE_OA_PROPERTY_OA_DISABLED
  3. Perform mmap on the OA buffer
  4. Read and inspect memory for residual kernel data

How to detect it

Inspect kernel logs and process activity for creation of OA streams with the disabled property followed by large mmap operations; correlate with any unusual memory reads from graphics buffers.

What your security team should do

  • Prioritize kernel upgrade on all affected systems within the next patch cycle
  • Limit untrusted local accounts from accessing the Xe graphics driver where feasible
  • Review recent local process activity for unexpected OA stream usage

The record

In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Zero OA buffer at allocation ttm_bo_type_kernel BOs are not guaranteed to be zeroed on allocation and may contain data from previously freed pages. Since the OA buffer is mmap'able by userspace, this can expose stale kernel memory contents. Streams opened with DRM_XE_OA_PROPERTY_OA_DISABLED allocate the OA buffer without calling xe_oa_init_oa_buffer(). Zero the buffer at allocation to prevent information disclosure through mmap. The existing zeroing in xe_oa_init_oa_buffer() remains necessary for zero report-id/timestamp detection on enable/re-enable. (cherry picked from commit 126c4c5388f9311a390b9b254a835b0cf0f55331)

Affected packages

Ecosystem Package Introduced Fixed