Description
In the Linux kernel, the following vulnerability has been resolved:

drm/i915: Fix memory leak in query_perf_config_list()

When krealloc() fails, free the original oa_config_ids before returning
to avoid a memory leak.

(cherry picked from commit 9977e9d84f46d4f12ad35fbbc0ec4638554bce87)
Published: 2026-09-25
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Memory leak leading to possible denial of service
Action: Apply Patch
AI Analysis

Impact

A failure in the drm/i915 module causes the kernel to leak memory when the query_perf_config_list() function is called and a reallocation fails. The leaked memory is not freed before the function returns, causing a gradual accumulation of unused memory objects. Over time this leak can degrade system performance, exhaust available memory, and potentially trigger a kernel panic if the system runs low on resources. The vulnerability is a classic memory‑leak weakness and does not directly allow attackers to execute code or gain elevated privileges.

Affected Systems

The issue exists in the Linux kernel, affecting all distributions that ship the default kernel variant and use the DRM i915 driver. No specific kernel version range is listed in the provided data, so any kernel containing the unpatched drm/i915 code is potentially vulnerable.

Risk and Exploitability

The exploitability of this flaw requires the ability to invoke query_perf_config_list(), which is typically a privileged or kernel‑level operation. The CVSS score is 5.5; the EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. Given the nature of the weakness, it is presumed to be a local vulnerability that can degrade availability over time rather than an immediate remote exploit.

Generated by OpenCVE AI on October 1, 2026 at 09:43 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply an updated Linux kernel that includes the commit fixing the memory leak
  • Reboot the system to ensure the patched kernel is active
  • Monitor system memory usage for unexpected growth as a temporary mitigation until a kernel update can be applied

Generated by OpenCVE AI on October 1, 2026 at 09:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4817-1 linux-6.12 security update
Debian DLA Debian DLA DLA-4841-1 linux security update
Debian DSA Debian DSA DSA-6528-1 linux security update
Ubuntu USN Ubuntu USN USN-8961-1 Linux kernel vulnerabilities
History

Sat, 03 Oct 2026 11:15:00 +0000


Thu, 01 Oct 2026 08:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-401

Wed, 30 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-772
References
Metrics threat_severity

None

cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Low


Fri, 25 Sep 2026 13:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-401

Fri, 25 Sep 2026 10:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix memory leak in query_perf_config_list() When krealloc() fails, free the original oa_config_ids before returning to avoid a memory leak. (cherry picked from commit 9977e9d84f46d4f12ad35fbbc0ec4638554bce87)
Title drm/i915: Fix memory leak in query_perf_config_list()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-19T09:10:25.686Z

Reserved: 2026-09-25T10:18:58.200Z

Link: CVE-2026-97899

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-25T11:17:16.677

Modified: 2026-10-19T10:17:40.043

Link: CVE-2026-97899

cve-icon Redhat

Severity : Low

Publid Date: 2026-09-25T00:00:00Z

Links: CVE-2026-97899 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T09:45:04Z

Weaknesses
  • CWE-772

    Missing Release of Resource after Effective Lifetime