Linux kernel drm/xe: vm_bind unwind leaves overlapping VMAs and corrupts the GPU VM state

CVSS 7.8CVE-2026-31479NVIDIA / GPU stackcurated

Impact

When a bind partially remaps the middle of an existing VMA and both mapped ends are already compatible, the xe driver skipped rebinding the ends and cleared the prev/next tracking while leaving the original VA range shrunken. If the bind vector then hits the unwind path, the two ends are never removed and a re-insertion overlaps them, tripping a WARNING in vm_bind_ioctl_ops_unwind() and leaving the GPU VM in an inconsistent state. The report came from a normal 3D workload issuing a vector of binds, so it is reachable without anything exotic. On a shared GPU node this is a tenant-triggerable corruption of per-VM address-space bookkeeping, and a node with a wedged VM generally has to be drained rather than recovered in place.

Who can reach it

Any local process with access to an Intel Xe GPU render node (/dev/dri/renderD*) that can call the xe VM_BIND ioctl - in a GPU cloud, any tenant with a pod that has the GPU device exposed. No elevated privilege required.

What to do

Update the host kernel or the xe driver to a build carrying the stable fix commits below and reboot the affected nodes; the fix changes VM bind bookkeeping in the kernel driver, so there is no userspace-side mitigation. Only nodes running Intel GPUs with the xe driver are affected.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-31479 https://git.kernel.org/stable/c/5eda8001ebb5269755608d678dd1f3928ab077c9 https://git.kernel.org/stable/c/ccd41f110c608b3cc347b9be881c3e72cd634b2b

Related entries

All NVIDIA / GPU stack entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.