The Linux kernel driver for DRM Xe contains a flaw in xe_exec_queue_create_ioctl() where error handling does not properly clean up execution queues. If the hardware engine group add fails while the virtual machine is in preempt fence mode, the queue remains on the VM's compute list after being freed, leaving a dangling pointer. Similarly, if memory allocation fails after the engine group add succeeds, the queue stays linked in the hardware engine group list and is then freed, causing a use‑after‑free condition. These errors can lead to memory corruption and potentially allow a local attacker to gain kernel privileges or crash the system. The weakness is a classic use‑after‑free bug.

All flavors of the Linux kernel that include the DRM Xe subsystem before the patch referenced in commit 37c831f4. The issue affects implementations where xe_exec_queue_create_ioctl() is exercised by DRM X‑e virtual machines or graphics workloads. No specific vendor or version numbers are listed, so any kernel containing the vulnerable code is potentially affected.

Based on the description, it is inferred that this flaw is a local kernel‑level issue that would require an attacker with sufficient privileges to execute code in the kernel context. No publicly available CVSS or EPSS score is listed, and the vulnerability is not in the CISA KEV catalog. Because the problem relies on internal state in the DRM Xe driver, it is inferred that widespread exploitation is unlikely without an additional local foothold. The use‑after‑free condition can lead to memory corruption, and it is inferred that a successful exploit could crash or compromise the host.