Executive brief
The Linux kernel's DRM Xe graphics driver has a flaw in how it handles GPU page faults from virtual machines (VMs). A non-fault-mode VM with scratch memory enabled could be incorrectly accepted by the page fault handler, leading to infinite GPU retry loops when the fault handler reports success without actually fixing the underlying fault. This can cause GPU hangs and denial of service on systems using Intel Xe GPUs.
Technical details
The vulnerability exists in the xe_pagefault_asid_to_vm() function in drivers/gpu/drm/xe/xe_pagefault.c. The code originally accepted both fault-mode and scratch-enabled VMs through an ASID lookup, but scratch memory alone does not enable recoverable fault handling. When a non-fault-mode VM (such as dma-fence or 3D mode) with scratch enabled faults on an already valid virtual memory address (VMA), the page fault handler incorrectly reports success without performing the necessary fault recovery. This causes the GPU to retry the faulting operation indefinitely, leading to GPU hangs. The fix restricts the ASID lookup to only accept fault-mode VMs, rejecting faults from 3D and other non-fault-mode VMs even if scratch is enabled. The patch modifies the condition from `xe_vm_in_fault_mode(vm) || xe_vm_has_scratch(vm)` to `xe_vm_in_fault_mode(vm)`.
Affected products
- Linux Linux kernel All versions with DRM Xe driver (Linux 6.0+)
Timeline
- 2026-08-20: other: Patch authored by Arvind Yadav
- 2026-09-17: disclosed: CVE-2026-90064 published