Linux i915 GPU kernel driver (execbuffer2 ioctl): MULTI-TENANT ISOLATION: The execbuffer2 ioctl accepted

Impact

MULTI-TENANT ISOLATION: The execbuffer2 ioctl accepted a userspace-supplied address without an access_ok() check, so a local user submitting GPU work could get the kernel to touch an arbitrary address. Execbuffer is the hot path every GPU workload uses, which makes this trivially reachable from any GPU-enabled container.

Who can reach it

Any local user or container with a DRM render node - i.e. any tenant that was scheduled a GPU. No privileged capability needed.

What to do

Fix ships in the Linux kernel. Update the kernel and reboot the node - in practice this is a drain plus reboot because the accelerator driver cannot be unloaded while jobs hold device file descriptors. No BIOS or firmware update needed.

References