Linux kernel (drivers/gpu/drm/xe): The Xe userptr path takes folio locks while holding the MMU notifier lock, which

Impact

The Xe userptr path takes folio locks while holding the MMU notifier lock, which inverts against core-kernel page migration doing the reverse. A tenant using userptr GPU mappings can deadlock the notifier against memory compaction/migration, hanging tasks that have nothing to do with the GPU and taking the node out for every workload on it.

Who can reach it

Any container with /dev/dri/renderD* on an Intel Xe host that registers userptr GPU mappings over its own anonymous memory; the collision happens when the kernel's page migration batches those folios at the same time as the driver marks them accessed/dirty. Needs no privilege - just userptr use plus normal memory pressure or THP compaction on the node.

What to do

Update to 6.12.25 / 6.14 or later, which drops the unnecessary mark-accessed/dirty under the notifier lock. Interim: deny render-node access to untrusted tenants on xe hosts; nothing in the driver disables userptr independently.

References

Related entries

• Linux kernel (drivers/gpu/drm/xe): A batched array of VM_BIND operations could evict other buffer objects belonging toCVE-2025-40086 · Linux kernel (drivers/gpu/drm/xe)Medium
• Linux kernel (drivers/gpu/drm/xe): A tenant's jobs can occupy the same copy engines the driver needs to service GPUCVE-2024-37026 · Linux kernel (drivers/gpu/drm/xe)Medium
• Linux kernel (drivers/gpu/drm/xe): Same per-client accounting path, different failure - if the fdinfo read drops theCVE-2024-46867 · Linux kernel (drivers/gpu/drm/xe)Medium
• Linux kernel (drivers/gpu/drm/xe): User VM_BIND work is scheduled onto engines that can themselves take page faultsCVE-2024-47729 · Linux kernel (drivers/gpu/drm/xe)Medium
• Linux kernel (drivers/gpu/drm/xe): Passing a sync object that fails fence lookup makes the exec ioctl return toCVE-2024-53086 · Linux kernel (drivers/gpu/drm/xe)Medium
• Linux kernel (drivers/gpu/drm/xe): Every exec ioctl that bails on an input-validation error leaves an exec-queueCVE-2024-53087 · Linux kernel (drivers/gpu/drm/xe)Medium