Linux kernel (drivers/gpu/drm/xe): Passing a sync object that fails fence lookup makes the exec ioctl return to

Impact

Passing a sync object that fails fence lookup makes the exec ioctl return to userspace while still holding the VM's dma-resv lock. That VM's buffers can then never be evicted, migrated or freed, so TTM eviction stalls and other tenants on the device are starved of VRAM until the node is rebooted.

Who can reach it

Tenant container holding /dev/dri/renderD* on Intel xe: call the exec ioctl with a syncobj handle whose in-fence lookup fails. One ioctl, deterministic, unprivileged.

What to do

Update to a kernel carrying the fix (stable commits below; no fixed_in published). Interim: none that is real - the lock is taken on the normal submit path; evacuate and reboot affected nodes.

References

Related entries

• Linux kernel (drivers/gpu/drm/xe): Every exec ioctl that bails on an input-validation error leaves an exec-queueCVE-2024-53087 · Linux kernel (drivers/gpu/drm/xe)Medium
• Linux kernel (drivers/gpu/drm/xe): The migration copy path falls back to a stack bounce buffer when the tenant's bufferCVE-2025-38690 · Linux kernel (drivers/gpu/drm/xe)Medium
• Linux kernel (drivers/gpu/drm/xe): On SR-IOV-partitioned Intel GPUs, the local-memory translation tables handed to a VFCVE-2025-38511 · Linux kernel (drivers/gpu/drm/xe)High
• Linux kernel (drivers/gpu/drm/xe): The Xe VRAM manager computed a buffer object's minimum page size by shifting aCVE-2024-42066 · Linux kernel (drivers/gpu/drm/xe)High
• Linux kernel (drivers/gpu/drm/xe): Freeing a scheduler job dereferences the VM it belongs to, but the final exec-queueCVE-2024-44978 · Linux kernel (drivers/gpu/drm/xe)High
• Linux kernel (drivers/gpu/drm/xe): The preempt-fence lock lives inside the exec queue, but the queue reference isCVE-2024-46683 · Linux kernel (drivers/gpu/drm/xe)High