Executive brief
A vulnerability was identified in the Linux kernel's Intel Xe graphics driver. The driver's memory management component failed to properly block write operations to memory areas designated as read-only. This flaw could allow a local user to cause a system crash or instability, potentially leading to a denial-of-service condition.
Technical details
A vulnerability exists in the xe_pagefault_service function within the Intel Xe DRM driver (drivers/gpu/drm/xe/xe_pagefault.c). The page fault handler did not check if a VMA was marked as read-only before permitting write or atomic access types. A local attacker with access to the GPU device can trigger this by attempting unauthorized write operations to read-only memory segments, potentially leading to kernel instability or a denial of service. The issue has been resolved by adding a check to reject non-read access types for read-only VMAs with an EPERM error.
Affected products
- Linux Linux Kernel 6.19.1 to 6.19.12, 7.0-rc1 to 7.0-rc6
Timeline
- 2026-03-24: other: Patch authored
- 2026-05-01: disclosed
- 2026-05-01: advisory
- 2026-05-12: other: NIST initial analysis completed