Linux kernel (drivers/gpu/drm/xe): The error path of the Xe VRAM clear helper waits on a fence pointer that is only

Impact

The error path of the Xe VRAM clear helper waits on a fence pointer that is only stable while the job mutex is held, so a racing submission can free it underneath the waiter. A tenant that can drive migration/clear failures gets a use-after-free on a dma-fence in the buffer-migration path - kernel memory corruption from an unprivileged container.

Who can reach it

Requires a container with /dev/dri/renderD* on an Intel Xe node. VRAM clear runs when buffer objects are allocated and evicted, so a tenant reaches it just by churning BO allocations under memory pressure; the race window opens when the clear submission fails and another thread is concurrently replacing the migration fence.

What to do

Boot a kernel containing the fix commits below. Interim mitigation is limited to removing render-node access from untrusted tenants; VRAM clear on allocation cannot be disabled.

References