Database/Kernel, userspace & hypervisor
Linux kernel (drivers/gpu/drm/xe): The error path of the Xe VRAM clear helper waits on a fence pointer that is only
Impact
The error path of the Xe VRAM clear helper waits on a fence pointer that is only stable while the job mutex is held, so a racing submission can free it underneath the waiter. A tenant that can drive migration/clear failures gets a use-after-free on a dma-fence in the buffer-migration path - kernel memory corruption from an unprivileged container.
Who can reach it
Requires a container with /dev/dri/renderD* on an Intel Xe node. VRAM clear runs when buffer objects are allocated and evicted, so a tenant reaches it just by churning BO allocations under memory pressure; the race window opens when the clear submission fails and another thread is concurrently replacing the migration fence.
What to do
Boot a kernel containing the fix commits below. Interim mitigation is limited to removing render-node access from untrusted tenants; VRAM clear on allocation cannot be disabled.
References
Related entries
- Linux kernel (drivers/gpu/drm/xe): Xe frees data that its exported dma-fences still point at - notably the timelineCVE-2025-38703 · Linux kernel (drivers/gpu/drm/xe)High
- Linux kernel (drivers/gpu/drm/xe): A tenant that submits a deliberately malformed array bind to the Xe VM_BIND ioctlCVE-2025-38731 · Linux kernel (drivers/gpu/drm/xe)High
- Linux kernel (drivers/gpu/drm/xe): On the migration error path the previous fence is released before the code waits onCVE-2025-39740 · Linux kernel (drivers/gpu/drm/xe)High
- Linux kernel (drivers/gpu/drm/xe): The observation-config ioctl dereferences the config object after releasing the lockCVE-2025-71099 · Linux kernel (drivers/gpu/drm/xe)High
- Linux kernel (drivers/gpu/drm/xe): The Xe userptr path takes folio locks while holding the MMU notifier lock, whichCVE-2025-37868 · Linux kernel (drivers/gpu/drm/xe)Medium
- Linux kernel (drivers/gpu/drm/xe): A batched array of VM_BIND operations could evict other buffer objects belonging toCVE-2025-40086 · Linux kernel (drivers/gpu/drm/xe)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.