Linux kernel (drivers/gpu/drm/xe): User VM_BIND work is scheduled onto engines that can themselves take page faults

Impact

User VM_BIND work is scheduled onto engines that can themselves take page faults, and resolving those faults depends on the bind completing. A tenant issuing binds on a fault-capable device deadlocks the GPU, and the device stops serving every other tenant on it until the node is reset.

Who can reach it

Tenant container holding /dev/dri/renderD* on an Intel xe device with recoverable page faults enabled: issue VM_BIND operations against a faulting VM. No capabilities required. Not reachable on xe platforms without recoverable faults.

What to do

Update to a kernel carrying the fix (stable commits below; no fixed_in published). Interim: disable recoverable page faults / SVM on shared xe devices.

References

Related entries

• Linux kernel (drivers/gpu/drm/xe): Passing a sync object that fails fence lookup makes the exec ioctl return toCVE-2024-53086 · Linux kernel (drivers/gpu/drm/xe)Medium
• Linux kernel (drivers/gpu/drm/xe): Every exec ioctl that bails on an input-validation error leaves an exec-queueCVE-2024-53087 · Linux kernel (drivers/gpu/drm/xe)Medium
• Linux kernel (drivers/gpu/drm/xe): The migration copy path falls back to a stack bounce buffer when the tenant's bufferCVE-2025-38690 · Linux kernel (drivers/gpu/drm/xe)Medium
• Linux kernel (drivers/gpu/drm/xe): On SR-IOV-partitioned Intel GPUs, the local-memory translation tables handed to a VFCVE-2025-38511 · Linux kernel (drivers/gpu/drm/xe)High
• Linux kernel (drivers/gpu/drm/xe): The Xe VRAM manager computed a buffer object's minimum page size by shifting aCVE-2024-42066 · Linux kernel (drivers/gpu/drm/xe)High
• Linux kernel (drivers/gpu/drm/xe): Freeing a scheduler job dereferences the VM it belongs to, but the final exec-queueCVE-2024-44978 · Linux kernel (drivers/gpu/drm/xe)High