Executive brief
The Intel Xe DRM driver in Linux kernel has a bug in its graphics memory page table management that fails to properly handle purged (freed) buffer objects. When the GPU driver attempts to walk page tables for purged memory, it accesses uninitialized data structures, causing kernel warnings and potential instability. This affects systems using Intel Xe GPUs and can impact system reliability during GPU memory management operations.
Technical details
The vulnerability is an uninitialized variable access (CWE-908) in the Xe DRM driver's page table binding code. During page table walks, the xe_pt_stage_bind() function skips initializing the xe_res_cursor structure for purged buffer objects, but the functions xe_pt_hugepte_possible() and xe_pt_scan_64K() did not check for purged BOs before attempting to dereference this uninitialized cursor via xe_res_dma() and xe_res_next() calls. This results in kernel warnings when invalid memory is accessed. The vulnerability is triggered through normal GPU memory management operations when buffer objects are purged, requiring no special authentication or network access. The fix adds explicit checks for purged BOs in the affected functions and zero-initializes the cursor structure to prevent garbage data propagation.
Affected products
- Linux Linux kernel Xe DRM driver (affected in 6.x and later kernels with Xe support)
Timeline
- 2026-08-15: disclosed
- 2026-06-25: patched: Fix committed upstream
- 2026-07-24: other: Backported to stable kernel trees