The Linux kernel's drm/xe driver had a vulnerability where a dma-buf attachment leak occurred in the xe_gem_prime_import() function. Specifically, if xe_dma_buf_init_obj() fails, the attachment created by dma_buf_dynamic_attach() is not properly detached, causing a resource leak. The patch adds a call to dma_buf_detach() before returning the error to prevent this leak. The fix was carefully implemented to avoid double-freeing the buffer object, as the existing error path frees it already. This vulnerability affects Linux kernel versions before 7.0.0-28.28.1.

The vulnerability leads to a dma-buf attachment leak, which can cause resource exhaustion or instability in the kernel's Direct Rendering Manager (DRM) subsystem. The CVSS vector indicates local attack vector with low complexity and low privileges required, and the impact is high on confidentiality, integrity, and availability. However, no known exploits are reported in the wild.

A fix is available in Linux kernel versions 7.0.0-28.28.1 and later. Users and administrators should update to these or later kernel versions to remediate this vulnerability. Since this is not a cloud service, manual patching is required. There are no vendor advisories indicating no action is needed, so applying the official fix is recommended.