Executive brief
A vulnerability in the Linux kernel's Intel Xe graphics driver could allow a local user to cause a system crash or potentially gain unauthorized access to memory. The issue occurs when the driver fails to load or during system shutdown, where certain memory management tasks are not properly synchronized. This could lead to instability or data corruption on systems using Intel Xe graphics hardware.
Technical details
A vulnerability in the Linux kernel's Intel Xe graphics driver (drm/xe) involves insufficient protection for Global Graphics Translation Table (GGTT) Memory Mapped I/O (MMIO) access. The existing protection mechanism, drm_dev_enter, fails if the driver load sequence is interrupted or fails, as drm_dev_unplug() is never reached. Furthermore, asynchronous worker threads may attempt to free Buffer Objects (BOs) with GGTT mappings after the MMIO region has been removed. This race condition allows for invalid MMIO access. The fix introduces an explicit 'ONLINE' flag protected by the GGTT lock to ensure access is disabled during teardown.
Affected products
- Linux Linux Kernel 6.12 to 6.12.77, 6.13 to 6.18.19, 6.19 to 6.19.9, 7.0-rc1 to 7.0-rc4
Timeline
- 2026-03-10: other: Patch authored
- 2026-04-03: disclosed: CVE published
- 2026-05-20: other: NVD analysis completed