Executive brief
A vulnerability in the Linux kernel's Intel graphics driver (i915) can cause a system crash or denial of service. The issue occurs when the graphics hardware attempts to enter a low-power state while certain task priorities are still being processed. This can lead to a kernel panic, potentially disrupting operations and requiring a system reboot.
Technical details
A race condition exists in the drm/i915/gt component of the Linux kernel during engine parking. The 'preempt-to-busy' mechanism allows an active request to be replaced and retired before the hardware processes the preemption. If the engine begins the parking process (idling for power management) before the Command Streamer (CS) interrupt restores the 'queue_priority_hint', the kernel triggers a GEM_BUG_ON assertion because the priority hint is not at its expected minimum value. This reachable assertion (CWE-617) results in a kernel panic. The vulnerability is exploitable by a local user with sufficient privileges to interact with the graphics subsystem. Patches have been released across multiple stable kernel branches to reset the priority hint during the parking sequence.
Affected products
- Linux Linux Kernel 6.8.0-rc2 and earlier versions
Timeline
- 2024-03-18: patched: Initial patch authored by Chris Wilson
- 2024-05-01: disclosed: CVE-2024-26937 published
References
- https://git.kernel.org/stable/c/3b031e4fcb2740988143c303f81f69f18ce86325
- https://git.kernel.org/stable/c/4a3859ea5240365d21f6053ee219bb240d520895
- https://git.kernel.org/stable/c/67944e6db656bf1e986aa2a359f866f851091f8a
- https://git.kernel.org/stable/c/7eab7b021835ae422c38b968d5cc60e99408fb62
- https://git.kernel.org/stable/c/8fd9b0ce8c26533fe4d5d15ea15bbf7b904b611c
- https://git.kernel.org/stable/c/ac9b6b3e8d1237136c8ebf0fa1ce037dd7e2948f
- https://git.kernel.org/stable/c/aed034866a08bb7e6e34d50a5629a4d23fe83703