Linux kernel (drivers/gpu/drm/xe): Every exec ioctl that bails on an input-validation error leaves an exec-queue

Impact

Every exec ioctl that bails on an input-validation error leaves an exec-queue reference permanently pinned. A tenant loops the ioctl with deliberately bad arguments and exhausts the finite GuC context id space and the GPU memory backing those queues, after which co-tenants can no longer create queues on that device.

Who can reach it

Tenant container holding /dev/dri/renderD* on Intel xe calls DRM_IOCTL_XE_EXEC in a loop with arguments chosen to fail validation after the exec-queue lookup. Deterministic, unprivileged, no race required.

What to do

Update to a kernel carrying the fix (stable commits below; no fixed_in published). Interim: cap per-tenant GPU context counts if your runtime supports it; otherwise a node reboot is the only way to reclaim the leaked queues.

References

Related entries

• Linux kernel (drivers/gpu/drm/xe): The migration copy path falls back to a stack bounce buffer when the tenant's bufferCVE-2025-38690 · Linux kernel (drivers/gpu/drm/xe)Medium
• Linux kernel (drivers/gpu/drm/xe): On SR-IOV-partitioned Intel GPUs, the local-memory translation tables handed to a VFCVE-2025-38511 · Linux kernel (drivers/gpu/drm/xe)High
• Linux kernel (drivers/gpu/drm/xe): The Xe VRAM manager computed a buffer object's minimum page size by shifting aCVE-2024-42066 · Linux kernel (drivers/gpu/drm/xe)High
• Linux kernel (drivers/gpu/drm/xe): Freeing a scheduler job dereferences the VM it belongs to, but the final exec-queueCVE-2024-44978 · Linux kernel (drivers/gpu/drm/xe)High
• Linux kernel (drivers/gpu/drm/xe): The preempt-fence lock lives inside the exec queue, but the queue reference isCVE-2024-46683 · Linux kernel (drivers/gpu/drm/xe)High
• Linux kernel (drivers/gpu/drm/xe): The per-client memory accounting walks buffer-object state (TTM resource, tt pages)CVE-2024-46866 · Linux kernel (drivers/gpu/drm/xe)High