CVE-2026-46264

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/xe/pf: Fix sysfs initialization<br /> <br /> In case of devm_add_action_or_reset() failure the provided cleanup<br /> action will be run immediately on the not yet initialized kobject.<br /> This may lead to errors like:<br /> <br /> [ ] kobject: &amp;#39;(null)&amp;#39; (ff110001393608e0): is not initialized, yet kobject_put() is being called.<br /> [ ] WARNING: lib/kobject.c:734 at kobject_put+0xd9/0x250, CPU#0: kworker/0:0/9<br /> [ ] RIP: 0010:kobject_put+0xdf/0x250<br /> [ ] Call Trace:<br /> [ ] xe_sriov_pf_sysfs_init+0x21/0x100 [xe]<br /> [ ] xe_sriov_pf_init_late+0x87/0x2b0 [xe]<br /> [ ] xe_sriov_init_late+0x5f/0x2c0 [xe]<br /> [ ] xe_device_probe+0x5f2/0xc20 [xe]<br /> [ ] xe_pci_probe+0x396/0x610 [xe]<br /> [ ] local_pci_probe+0x47/0xb0<br /> <br /> [ ] refcount_t: underflow; use-after-free.<br /> [ ] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0x68/0xb0, CPU#0: kworker/0:0/9<br /> [ ] RIP: 0010:refcount_warn_saturate+0x68/0xb0<br /> [ ] Call Trace:<br /> [ ] kobject_put+0x174/0x250<br /> [ ] xe_sriov_pf_sysfs_init+0x21/0x100 [xe]<br /> [ ] xe_sriov_pf_init_late+0x87/0x2b0 [xe]<br /> [ ] xe_sriov_init_late+0x5f/0x2c0 [xe]<br /> [ ] xe_device_probe+0x5f2/0xc20 [xe]<br /> [ ] xe_pci_probe+0x396/0x610 [xe]<br /> [ ] local_pci_probe+0x47/0xb0<br /> <br /> Fix that by calling kobject_init() and kobject_add() separately<br /> and register cleanup action after the kobject is initialized.<br /> <br /> Also make this cleanup registration a part of the create helper to<br /> fix another mistake, as in the loop we were wrongly passing parent<br /> kobject while registering cleanup action, and this resulted in some<br /> undetected leaks.<br /> <br /> (cherry picked from commit 98b16727f07e26a5d4de84d88805ce7ffcfdd324)