Database/Kernel, userspace & hypervisor
Linux kernel (drivers/gpu/drm/xe): On the migration error path the previous fence is released before the code waits on
Impact
On the migration error path the previous fence is released before the code waits on it, so the wait runs against freed memory. Migration is what moves buffer objects between VRAM and system memory under pressure, so a tenant that keeps the GPU memory-constrained can reach this use-after-free while other tenants' buffers are being evicted around it.
Who can reach it
A tenant container holding /dev/dri/renderD* on an Intel xe GPU triggers it through ordinary buffer-object migration/eviction, forced by allocating VRAM until eviction kicks in and then failing the copy. No special capability, no display path, no host root.
What to do
Boot a kernel carrying the xe_migrate fence-ordering fix below. Interim: cap per-tenant VRAM so a single container cannot keep the device in constant eviction, which is the state that exercises this path.
References
Related entries
- Linux kernel (drivers/gpu/drm/xe): The observation-config ioctl dereferences the config object after releasing the lockCVE-2025-71099 · Linux kernel (drivers/gpu/drm/xe)High
- Linux kernel (drivers/gpu/drm/xe): The Xe userptr path takes folio locks while holding the MMU notifier lock, whichCVE-2025-37868 · Linux kernel (drivers/gpu/drm/xe)Medium
- Linux kernel (drivers/gpu/drm/xe): A batched array of VM_BIND operations could evict other buffer objects belonging toCVE-2025-40086 · Linux kernel (drivers/gpu/drm/xe)Medium
- Linux kernel (drivers/gpu/drm/xe): A tenant's jobs can occupy the same copy engines the driver needs to service GPUCVE-2024-37026 · Linux kernel (drivers/gpu/drm/xe)Medium
- Linux kernel (drivers/gpu/drm/xe): Same per-client accounting path, different failure - if the fdinfo read drops theCVE-2024-46867 · Linux kernel (drivers/gpu/drm/xe)Medium
- Linux kernel (drivers/gpu/drm/xe): User VM_BIND work is scheduled onto engines that can themselves take page faultsCVE-2024-47729 · Linux kernel (drivers/gpu/drm/xe)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.