Bug 2546347 (CVE-2026-98280)

Summary: CVE-2026-98280 kernel: drm/xe/i2c: Disable IRQ on unbind
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel's Intel Xe graphics driver. During device unbinding, internal driver structures are freed before interrupt requests (IRQs) are disabled. If an interrupt occurs during this timing window, it can trigger a use-after-free condition where the system accesses already released memory. A local user could exploit this issue to cause a Denial of Service (DoS) via a system crash or potentially achieve privilege escalation.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-06 09:02:56 UTC 
In the Linux kernel, the following vulnerability has been resolved:

drm/xe/i2c: Disable IRQ on unbind

Currently, struct xe_i2c is freed before SGUnit IRQ is disabled in unbind
path, leaving a potential UAF in case I2C IRQ is hit during this small
window. Explicitly disable I2C IRQ in xe_i2c_remove() and fix this.

(cherry picked from commit 8ba5c8b8ab3fd362267c11df2cd5a90ee46f6e24)
Comment 1 gkamathe 2026-10-10 21:37:24 UTC 
Upstream advisory:
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98280.mbox