Linux kernel (drivers/gpu/drm/i915/gt): Compression (CCS) metadata attached to local memory was not cleared when the

CVSS 5.5CVE-2022-50037Kernel, userspace & hypervisorcurated

Impact

Compression (CCS) metadata attached to local memory was not cleared when the memory was handed to a new owner, so a tenant receiving recycled VRAM inherits the previous tenant's compression state. The upstream fix is worded exactly that way - the kernel was leaking the CCS state from the previous user - which is residual-data exposure across workloads sharing a discrete Intel GPU.

Who can reach it

A tenant container holding /dev/dri/renderD* on a discrete Intel GPU allocates local memory that a previous tenant freed and reads it back with the compression state still attached. Purely local, unprivileged, no display or profiling access needed; only affects hosts with discrete Intel (lmem-capable) GPUs shared serially between workloads.

What to do

Boot a kernel carrying the i915 CCS-state fix below. Interim: do not recycle a GPU between tenants without a full device reset/scrub cycle, and prefer whole-device-per-tenant scheduling on discrete Intel cards until patched.

References

https://git.kernel.org/stable/c/b431cffb4883b9e90d48f0c408674c50fef428a5 https://git.kernel.org/stable/c/232d150fa15606e96c0e01e5c7a2d4e03f621787 https://nvd.nist.gov/vuln/detail/CVE-2022-50037

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.