Linux kernel (drivers/gpu/drm/xe): The migration copy path falls back to a stack bounce buffer when the tenant's buffer

Impact

The migration copy path falls back to a stack bounce buffer when the tenant's buffer is not cacheline-aligned, but that bounce buffer has no alignment guarantee either, so the function recurses into itself until the kernel stack is exhausted. The result is a kernel panic triggered on demand by one tenant, taking the node - and every other tenant's job on it - down.

Who can reach it

A tenant container holding /dev/dri/renderD* on an Intel xe GPU passes a misaligned buffer/offset into the VRAM access path; upstream hit it through the GPU debug interface, and any caller that reaches xe_migrate's non-aligned copy fallback does the same. Unprivileged, render-node only.

What to do

Boot a kernel carrying the xe_migrate bounce-buffer fix below. Interim: deny the GPU debug/eudebug interface to tenant containers, and drop /dev/dri/renderD* from workloads that do not need direct VRAM access.

References

Related entries

• Linux kernel (drivers/gpu/drm/xe): On SR-IOV-partitioned Intel GPUs, the local-memory translation tables handed to a VFCVE-2025-38511 · Linux kernel (drivers/gpu/drm/xe)High
• Linux kernel (drivers/gpu/drm/xe): The Xe VRAM manager computed a buffer object's minimum page size by shifting aCVE-2024-42066 · Linux kernel (drivers/gpu/drm/xe)High
• Linux kernel (drivers/gpu/drm/xe): Freeing a scheduler job dereferences the VM it belongs to, but the final exec-queueCVE-2024-44978 · Linux kernel (drivers/gpu/drm/xe)High
• Linux kernel (drivers/gpu/drm/xe): The preempt-fence lock lives inside the exec queue, but the queue reference isCVE-2024-46683 · Linux kernel (drivers/gpu/drm/xe)High
• Linux kernel (drivers/gpu/drm/xe): The per-client memory accounting walks buffer-object state (TTM resource, tt pages)CVE-2024-46866 · Linux kernel (drivers/gpu/drm/xe)High
• Linux kernel (drivers/gpu/drm/xe): The GPU VM is published into the id table before the create ioctl finishes with itCVE-2024-49865 · Linux kernel (drivers/gpu/drm/xe)High