GPU VulnDB

Database/NVIDIA / GPU stack

Linux kernel drm/xe: use-after-free in SR-IOV PF VF migration restore after an error

CVSS 7.8CVE-2026-31490NVIDIA / GPU stackcurated

Impact

In the Intel Xe driver's SR-IOV physical-function code, a failed xe_sriov_pf_migration_restore_produce() leaves a stale data pointer. The next write to the restore interface then uses freed memory in the host kernel. This affects hosts that split Intel Xe GPUs into SR-IOV virtual functions for VMs and migrate those VFs. Memory corruption in the host kernel there affects every guest on that GPU. The affected kernels listed are 6.19 and 7.0 only.

Who can reach it

Local, on the host. A process that drives the VF migration-restore write path, normally the VMM or migration tooling running with host privileges. The record does not say whether a guest or the source side of a migration can steer the restore data into the error path.

What to do

Install a kernel with the stable fix (commits below), then drain and reboot each affected host. The guests must be migrated off or stopped first. Hosts that do not use Xe SR-IOV VF migration do not reach this code.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-31490https://git.kernel.org/stable/c/87997b6c6516e049cbaf2fc6810b213d587a06b1https://git.kernel.org/stable/c/e28552b4ddea5cb4725380dd08237831af835124

Related entries

All NVIDIA / GPU stack entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.