CVE-2026-52950 is a use-after-free vulnerability in the Linux kernel drm/xe/dma-buf subsystem. The flaw was due to a retry loop that failed because the buffer object was freed on error, causing a use-after-free condition. The fix involved restructuring the allocation and initialization so that the retry is safe by combining allocation and initialization into one unit. This vulnerability affects linux-hwe-edge kernel versions prior to 7.0.0-28.28 and related builds. The issue was reported by Sashiko and resolved in kernel updates released by Ubuntu. The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating local attack vector with low complexity, requiring low privileges, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vendor advisory confirms a patch is available and recommends updating to fixed kernel versions.

The vulnerability allows a local attacker with low privileges to exploit a use-after-free condition in the drm/xe/dma-buf subsystem, potentially leading to full system compromise with high impact on confidentiality, integrity, and availability. The flaw could be used to execute arbitrary code or cause denial of service by corrupting kernel memory. The CVSS score of 7.8 reflects the serious nature of this vulnerability. However, no known exploits in the wild have been reported at this time.

A patch is available and included in updated Linux kernel packages for the linux-hwe-edge kernel. Users should apply the latest kernel updates as provided by their distribution vendor and reboot the system to ensure the fix is applied. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be required. Follow vendor instructions carefully to complete the update process.