Executive brief
The Linux kernel's Intel XE GPU driver contains a flaw in its SR-IOV (virtualization) mode where the Physical Function improperly processes certain message types in the GPU firmware relay protocol. This could cause the GPU driver to crash or violate the communication contract between virtual and physical GPU instances, leading to system instability or service interruption in virtualized GPU environments.
Technical details
The vulnerability is a protocol violation in the DRM/XE GuC (Graphics Unified Command) relay handler for SR-IOV PF (Physical Function) implementations. The vulnerable code in xe_guc_relay.c attempted to process FAST_REQUEST and EVENT message types when they should only handle regular REQUEST messages according to the VFPF (Virtual Function / Physical Function) ABI specification. The flaw is triggered when the PF receives a FAST_REQUEST or EVENT relay message, causing either an assertion failure or protocol corruption. The fix restricts the PF handler to only accept GUC_HXG_TYPE_REQUEST message types and reject others with -EOPNOTSUPP. This affects systems using Intel XE GPU virtualization, and patches are available in upstream Linux kernel commits.
Affected products
- Linux Linux kernel Multiple versions in stable branches (linux-5.x.y, linux-6.x.y, linux-7.x.y)
Timeline
- 2026-08-15: disclosed: CVE-2026-72360 published
- 2026-05-27: patched: Fix committed upstream (commit ed8b0d731892c68b41ecbd27c952af284816dec1)
- 2026-07-24: patched: Fix applied to stable branches