Linux i915 GPU kernel driver (execbuffer VMA array): MULTI-TENANT ISOLATION: The execbuffer VMA array

Impact

MULTI-TENANT ISOLATION: The execbuffer VMA array was not zero-initialised, so uninitialised kernel stack/heap contents could be acted on or leaked back through the GPU submission path. Info-leak-grade on its own, and useful as the KASLR-defeating first stage for one of the neighbouring i915 use-after-frees.

Who can reach it

Any local user or container with a DRM render node - i.e. any tenant that was scheduled a GPU. No privileged capability needed.

What to do

Fix ships in the Linux kernel. Update the kernel and reboot the node - in practice this is a drain plus reboot because the accelerator driver cannot be unloaded while jobs hold device file descriptors. No BIOS or firmware update needed.

References