CVE detail
CVE-2026-52950
In the Linux kernel, the following vulnerability has been resolved: drm/xe/dma-buf: fix UAF with retry loop Retry doesn't work here, since bo will be freed on error, leading to UAF. However, now that we do the alloc & init before the attach, we can now combine this as one unit and have the init do the alloc for us. This should make the retry safe. Reported by Sashiko. v2: Fix up the error unwind (CI) (cherry picked from commit 479669418253e0f27f8cf5db01a731352ea592e7)
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 22.0 · diversity 13.0 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 0
- within the 30d window
- Peak daily
- 0
- highest bucket
Evidence
Source links by recency
8 source links · newest first
- https://access.redhat.com/errata/RHSA-2026:45192access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comJun 24, 2026, 5:17 PM - https://access.redhat.com/errata/RHSA-2026:42919access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comJun 24, 2026, 5:17 PM - https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52950.jsonsecurity.access.redhat.com
No excerpt available.
Vendor Advisorysecurity.access.redhat.comJun 24, 2026, 5:17 PM - https://bugzilla.redhat.com/show_bug.cgi?id=2492318bugzilla.redhat.com
No excerpt available.
Exploitbugzilla.redhat.comJun 24, 2026, 5:17 PM - https://access.redhat.com/security/cve/CVE-2026-52950access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comJun 24, 2026, 5:17 PM No excerpt available.
Vendor Advisorygit.kernel.orgJun 24, 2026, 5:17 PMNo excerpt available.
Vendor Advisorygit.kernel.orgJun 24, 2026, 5:17 PMNo excerpt available.
Vendor Advisorygit.kernel.orgJun 24, 2026, 5:17 PM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2026-53085CVSS 7.8 · High
In the Linux kernel, the following vulnerability has been resolved: bpf: fix mm lifecycle in open-coded task_vma iterator The open-coded task_vma iterator reads task->mm lockles…
- CVE-2026-53033CVSS 7.8 · High
In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Take state lock for af_unix iter When a BPF iterator program updates a sockmap, there is a race…
- CVE-2026-53006CVSS 9.8 · Critical
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible UAF in icmpv6_rcv() Caching saddr and daddr before pskb_pull() is problematic since skb->h…
- CVE-2026-52976CVSS 7.8 · High
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() Two error handling issues exist in xe_exec_queue_cr…
- CVE-2026-52973CVSS 7.8 · High
In the Linux kernel, the following vulnerability has been resolved: futex: Drop CLONE_THREAD requirement for private default hash alloc Currently need_futex_hash_allocate_defaul…
- CVE-2026-52924CVSS 9.8 · Critical
In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association…