Linux kernel (drivers/gpu/drm/nouveau/nvkm/subdev/instmem): Concurrent GPU work races the instance-memory pointer

Impact

Concurrent GPU work races the instance-memory pointer stores used while walking GPU page tables, and the kernel dereferences a torn pointer. One tenant's ordinary parallel workload oopses the kernel and takes the whole node down with every other tenant on it.

Who can reach it

Unprivileged tenant holding /dev/dri/renderD* on a nouveau device, running many concurrent submissions - a parallel Vulkan conformance-style load reproduced it within hours on stock hardware. No special capabilities, no device misconfiguration required. nouveau only.

What to do

Update to a stable kernel carrying the fix (no fixed_in published in the record; use the stable commits below). Interim: keep nouveau off shared GPU nodes, or drop /dev/dri from tenant containers on nouveau-driven hosts.

References