Executive brief
A vulnerability in the Linux kernel's Intel graphics driver could allow a local attacker to cause a system crash or potentially execute unauthorized code. The issue occurs due to a technical race condition when the system attempts to manage power for the graphics engine. This could disrupt operations or lead to a full system compromise on affected Linux machines using Intel hardware.
Technical details
A race condition exists in the i915 DRM driver within the intel_engine_park_heartbeat() function. The vulnerability is caused by a non-atomic read-and-clear operation on the 'heartbeat.systole' request pointer. When the heartbeat worker and the engine parking logic concurrently attempt to release the same request, a reference count underflow occurs, leading to a use-after-free scenario. An attacker with local access could exploit this to trigger a kernel panic or achieve arbitrary code execution. The fix involves using atomic xchg() operations to ensure only one thread processes the request pointer.
Affected products
- Linux Linux Kernel 5.5 to 5.15.203, 5.16 to 6.1.169, 6.2 to 6.6.135, 6.7 to 6.12.82, 6.13 to 6.18.23, 6.19 to 6.19.13
Timeline
- 2026-04-24: advisory: CVE-2026-31656 published by NVD
- 2026-04-18: patched: Fix committed to stable kernel trees
References
- https://git.kernel.org/stable/c/2af8b200cae3fdd0e917ecc2753b28bb40c876c1
- https://git.kernel.org/stable/c/455d98ed527fc94eed90406f90ab2391464ca657
- https://git.kernel.org/stable/c/4c71fd099513bfa8acab529b626e1f0097b76061
- https://git.kernel.org/stable/c/70d3e622b10092fc483e28e57b4e8c49d9cc7f68
- https://git.kernel.org/stable/c/82034799c6c14b3104668878c3f3e5786f777126
- https://git.kernel.org/stable/c/8ce44d28a84fd5e053a88b04872a89d95c0779d4
- https://git.kernel.org/stable/c/a00e92bf6583d019a4fb2c2df7007e6c9b269ce7