{"id":15473,"date":"2026-09-04T19:04:17","date_gmt":"2026-09-04T11:04:17","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-46264"},"modified":"2026-09-04T19:04:17","modified_gmt":"2026-09-04T11:04:17","slug":"cve-2026-46264","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-46264","title":{"rendered":"CVE-2026-46264 [HIGH] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\ndrm\/xe\/pf: Fix sysfs"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>drm\/xe\/pf: Fix sysfs initialization<\/p>\n<p>In case of devm_add_action_or_reset() failure the provided cleanup<br \/>\naction will be run immediately on the not yet initialized kobject.<br \/>\nThis may lead to errors like:<\/p>\n<p> [ ] kobject: &#8216;(null)&#8217; (ff110001393608e0): is not initialized, yet kobject_put() is being called.<br \/>\n [ ] WARNING: lib\/kobject.c:734 at kobject_put+0xd9\/0x250, CPU#0: kworker\/0:0\/9<br \/>\n [ ] RIP: 0010:kobject_put+0xdf\/0x250<br \/>\n [ ] Call Trace:<br \/>\n [ ]  xe_sriov_pf_sysfs_init+0x21\/0x100 [xe]<br \/>\n [ ]  xe_sriov_pf_init_late+0x87\/0x2b0 [xe]<br \/>\n [ ]  xe_sriov_init_late+0x5f\/0x2c0 [xe]<br \/>\n [ ]  xe_device_probe+0x5f2\/0xc20 [xe]<br \/>\n [ ]  xe_pci_probe+0x396\/0x610 [xe]<br \/>\n [ ]  local_pci_probe+0x47\/0xb0<\/p>\n<p> [ ] refcount_t: underflow; use-after-free.<br \/>\n [ ] WARNING: lib\/refcount.c:28 at refcount_warn_saturate+0x68\/0xb0, CPU#0: kworker\/0:0\/9<br \/>\n [ ] RIP: 0010:refcount_warn_saturate+0x68\/0xb0<br \/>\n [ ] Call Trace:<br \/>\n [ ]  kobject_put+0x174\/0x250<br \/>\n [ ]  xe_sriov_pf_sysfs_init+0x21\/0x100 [xe]<br \/>\n [ ]  xe_sriov_pf_init_late+0x87\/0x2b0 [xe]<br \/>\n [ ]  xe_sriov_init_late+0x5f\/0x2c0 [xe]<br \/>\n [ ]  xe_device_probe+0x5f2\/0xc20 [xe]<br \/>\n [ ]  xe_pci_probe+0x396\/0x610 [xe]<br \/>\n [ ]  local_pci_probe+0x47\/0xb0<\/p>\n<p>Fix that by calling kobject_init() and kobject_add() separately<br \/>\nand register cleanup action after the kobject is initialized.<\/p>\n<p>Also make this cleanup registration a part of the create helper to<br \/>\nfix another mistake, as in the loop we were wrongly passing parent<br \/>\nkobject while registering cleanup action, and this resulted in some<br \/>\nundetected leaks.<\/p>\n<p>(cherry picked from commit 98b16727f07e26a5d4de84d88805ce7ffcfdd324)<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>drm\/xe\/pf: Fix sysfs initialization<\/p>\n<p>In case of devm_add_action_or_reset() failure the provided cleanup<br \/>\naction will be run immediat<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-15473","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/15473","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15473"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15473"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15473"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}