CVE-2026-74440

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Wait on external BO…

Risk score: 62/100
CVSS: 7.8 v3.1
Exploit chance (30 days): 0.1%
Published: 15 Aug 2026

Open in the live forecast Today's forecast

What to know

What it is: In the Linux kernel, the following vulnerability has been resolved: drm/xe: Wait on external BO kernel fences in exec IOCTL Before arming a user job, xe_exec_ioctl() only added the VM's dma-resv KERNEL slot as a dependency. That slot covers rebinds and the kernel operations of the VM's private BOs, but not external BO…
Affected: Canonical Ubuntu Linux
Fix: Apply the vendor's security update; see the linked advisory.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Canonical Ubuntu Linux: Red, act today. A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests, causing a heap buffer overflow in the NGINX worker process leading to a restart, or potential…

The flaws

CVE-2026-74440: In the Linux kernel, the following vulnerability has been resolved: drm/xe: Wait on external BO… (CVSS 7.8 · EPSS 0%)
CVE-2026-93479: Heap buffer overflow can lead to remote code execution (CVSS 8.1 · EPSS 1%)
CVE-2026-15176: Heap buffer overflow can lead to remote code execution (CVSS 8.1 · EPSS 1%)
CVE-2026-97205: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module (CVSS 8.1 · EPSS 1%)

The fix

Fix: Check the linked advisory for the concrete fix.

Who is exposed: {'products': ['NGINX Plus', 'NGINX Open Source'], 'packages': [], 'versions': []}

Where it stands

No known exploitation

How it unfolded

26 Oct, Ubuntu security notices (official): USN-8955-1: nginx vulnerabilities
3 Nov, Ubuntu security notices (official): USN-8960-1: Linux kernel (OEM) vulnerabilities
3 Nov, Ubuntu security notices (official): USN-8959-1: Linux kernel vulnerabilities

Connects to

Same weakness: Heap buffer overflow (CWE-122). 398 other warnings in 30 days
Same product: Earlier Canonical Ubuntu Linux warnings. 89 in the last 90 days

Why it is Amber

CVSS 7.8 high
On your watchlist: linux kernel
Named in a government or vendor bulletin

Government and vendor bulletins

References

Original description

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Wait on external BO kernel fences in exec IOCTL Before arming a user job, xe_exec_ioctl() only added the VM's dma-resv KERNEL slot as a dependency. That slot covers rebinds and the kernel operations of the VM's private BOs, but not external BOs (bo->vm == NULL), which carry their kernel operations (evictions, moves, ...) in their own dma-resv KERNEL slot. The DMA_RESV_USAGE_KERNEL slot is the cross-driver contract for memory management operations that must complete before the BO or its backing store may be used: any accessor is required to wait on the KERNEL fences before touching the resv. By skipping the external BOs' KERNEL slots, the exec path violated that contract and could schedule a user job while a kernel operation on an external BO mapped by the VM was still in flight, racing against it and potentially reading or writing memory that was being moved. Replace the VM-only dependency with an iteration over every object locked by the exec, adding each object's KERNEL slot as a job dependency. This covers the VM resv (rebinds and private BOs) as well as every external BO, mirroring the drm_gpuvm_resv_add_fence() call that later publishes the job fence to the same set of objects. Long-running mode continues to skip this, as before. (cherry picked from commit a6b842acf3ddd1efc53a56de9260cfa718fb35e7)

Last activity 3 Nov 2026. Patch Forecast updates every hour.