{"cve":"CVE-2026-72361","nvd":{"published":"2026-08-15T06:22:09.530","modified":"2026-08-17T06:18:40.313","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/hw_engine: Fix double-free of managed BO in error path\n\nThe error path in hw_engine_init() explicitly frees a BO allocated\nwith xe_managed_bo_create_pin_map() via xe_bo_unpin_map_no_vm().\nSince the managed BO already has a devm cleanup action registered,\nthis causes a double-free when devm unwinds during probe failure.\n\nRemove the explicit free and let devm handle it, consistent with\nall other xe_managed_bo_create_pin_map() callers.\n\n(cherry picked from commit e459a3bdeb117be496d7f229e2ea1f6c9fe4080b)","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/1f6b44d555ecce61e249220f2ca4d75cdb90caf6","https://git.kernel.org/stable/c/23ee91355e31947595b86ebb9ef4664f20fd926d","https://git.kernel.org/stable/c/7ac3cae7a251d28e9079de07a991bd4eb2bb7fd8","https://git.kernel.org/stable/c/a0a56b4480a0dc921a42cd70e9fc081a12ab8359"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:48:17.459049833+00:00"},"epss":{"cve":"CVE-2026-72361","score":0.00209,"percentile":0.11049,"date":"2026-11-01"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}