Linux kernel (drivers/gpu/drm/xe): The Xe VRAM manager computed a buffer object's minimum page size by shifting a

Impact

The Xe VRAM manager computed a buffer object's minimum page size by shifting a 32-bit alignment value, which overflows before it is stored into a 64-bit field. A tenant that requests a large page alignment gets a wrong, truncated minimum size back into the VRAM allocator, which is how allocations end up smaller or worse-aligned than the driver believes - the setup for one tenant's buffer overlapping memory the allocator considers someone else's.

Who can reach it

Reachable from a container holding /dev/dri/renderD* on an Intel Xe node through ordinary buffer-object creation with attacker-chosen size and alignment; the overflow is in the TTM VRAM manager's allocation path, so no special ioctl or privilege is needed.

What to do

Boot a kernel containing the fix commits below. No practical interim control other than withholding render-node access from untrusted tenants.

References