{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.94-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.0.10-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()  Two error handling issues exist in xe_exec_queue_create_ioctl():  1. When xe_hw_engine_group_add_exec_queue() fails, the error path jumps    to put_exec_queue which skips xe_exec_queue_kill(). If the VM is in    preempt fence mode, xe_vm_add_compute_exec_queue() has already added    the queue to the VM's compute exec queue list. Skipping the kill    leaves the queue on that list, leading to a dangling pointer after    the queue is freed.  2. When xa_alloc() fails after xe_hw_engine_group_add_exec_queue() has    succeeded, the error path does not call    xe_hw_engine_group_del_exec_queue() to remove the queue from the hw    engine group list. The queue is then freed while still linked into    the hw engine group, causing a use-after-free.  Fix both by: - Changing the xe_hw_engine_group_add_exec_queue() failure path to jump   to kill_exec_queue so that xe_exec_queue_kill() properly removes the   queue from the VM's compute list. - Adding a del_hw_engine_group label before kill_exec_queue for the   xa_alloc() failure path, which removes the queue from the hw engine   group before proceeding with the rest of the cleanup.  (cherry picked from commit 37c831f401746a45d510b312b0ed7a77b1e06ec8)",
  "id": "DEBIAN-CVE-2026-52976",
  "modified": "2026-09-14T16:47:37.781997540Z",
  "published": "2026-06-24T17:17:08.183Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-52976"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-52976"
  ]
}