Database/Kernel, userspace & hypervisor
Linux kernel (drivers/gpu/drm/xe): The per-client memory accounting walks buffer-object state (TTM resource, tt pages)
Impact
The per-client memory accounting walks buffer-object state (TTM resource, tt pages) with no lock and no reference held. A tenant that keeps BOs churning while its fdinfo is read gets the kernel to follow freed pointers - use-after-free and NULL dereference in kernel context, the usual starting point for a container escape.
Who can reach it
Tenant holding /dev/dri/renderD* on Intel xe, plus anything that reads /proc/<pid>/fdinfo for that DRM fd - which the tenant can do to itself, and which fleet GPU-telemetry agents do continuously across tenants. One thread allocates and evicts BOs while the other reads fdinfo. No capabilities needed.
What to do
Update to a kernel with the fix (stable commits below; no fixed_in published). Interim: stop any fleet agent that scrapes DRM fdinfo on xe nodes - it does not remove the self-triggered path but it removes the cross-tenant one.
References
Related entries
- Linux kernel (drivers/gpu/drm/xe): The GPU VM is published into the id table before the create ioctl finishes with itCVE-2024-49865 · Linux kernel (drivers/gpu/drm/xe)High
- Linux kernel (drivers/gpu/drm/xe): The observation/OA path reuses one batch buffer and appends a batch-end command onCVE-2024-50090 · Linux kernel (drivers/gpu/drm/xe)High
- Linux kernel (drivers/gpu/drm/xe): Xe freed a job from inside timeout-detection-and-recovery while the submissionCVE-2024-50149 · Linux kernel (drivers/gpu/drm/xe)High
- Linux kernel (drivers/gpu/drm/xe): A tenant that suspends an exec queue and then closes it while the GuCCVE-2024-56552 · Linux kernel (drivers/gpu/drm/xe)High
- Linux kernel (drivers/gpu/drm/xe): Xe built its scatter-gather table from HMM page pointers without holding theCVE-2025-21939 · Linux kernel (drivers/gpu/drm/xe)High
- Linux kernel (drivers/gpu/drm/xe): A GPU TLB invalidation for a very large address range computes its length with aCVE-2025-37761 · Linux kernel (drivers/gpu/drm/xe)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.