Executive brief
The Linux kernel's DRM/xe graphics driver incorrectly allocates compressed graphics memory (flat CCS storage) as usable VRAM to the memory allocator. This causes hardware compression metadata to overwrite kernel memory structures that were allocated in that range, leading to system crashes and data corruption. On affected systems, this results in graphics subsystem failures and potential black screens on boot.
Technical details
The vulnerability exists in the drm/xe driver's get_flat_ccs_offset() function, which reads the flat CCS storage base from hardware, scales it by the number of enabled L3 nodes, and rounds the result up to 128K before exposing the memory below that point to the VRAM allocator. This rounding-up operation publishes unmapped CCS storage regions as free memory. When kernel page tables or other critical structures are allocated within this CCS region, the hardware compression engine silently overwrites them without page table entries, buffer objects, or GPU submissions. The root cause is the use of round_up() instead of round_down() when calculating the usable memory boundary. An attacker cannot directly trigger this; it manifests as memory corruption when the allocator happens to place structures in CCS-owned pages, causing graphics failures or system crashes. A patch is available that replaces round_up() with round_down() to properly exclude CCS storage from user allocation.
Affected products
- Linux Linux kernel affected versions with DRM/xe driver and Battlemage G21 GPU or similar hardware with unaligned flat CCS base
Timeline
- 2026-09-16: disclosed: Vulnerability disclosed via Linux kernel commit