Executive brief
A debugging feature in the Linux kernel's GPU driver (DRM/XE) can trigger an incorrect lock assertion when test injection is enabled. This causes the kernel to fail assertions and warn, potentially leading to system instability or denial of service. The issue affects systems with the optional DRM_XE_USERPTR_INVAL_INJECT debug configuration enabled.
Technical details
The vulnerability is a lock synchronization bug in the drm/xe/userptr component. When CONFIG_DRM_XE_USERPTR_INVAL_INJECT is enabled, the xe_pt_svm_userptr_pre_commit() function holds notifier_lock for read, but the test injection path calls xe_vma_userptr_force_invalidate() which expects the lock to be held for write. This mismatch causes drm_gpusvm_unmap_pages() to fail a lock assertion (WARNING at drm_gpusvm.c:1669). The fix acquires notifier_lock for write in pre-commit when the inject Kconfig is enabled via new helper functions. Production builds without the debug config retain the original read-mode behavior. The attack vector requires kernel code execution or the ability to trigger the userptr test injection path.
Affected products
- Linux Linux kernel 5.x–6.x (subject to CONFIG_DRM_XE_USERPTR_INVAL_INJECT)
Timeline
- 2026-08-28: disclosed
- 2026: patched: Fix committed as 80ccbd97ffee8ad2e73167d826fe7be548364365 and cherry-picked