Linux kernel i915: siblings[] array leaked when a later context-creation extension fails

Impact

After a successful BALANCE or PARALLEL_SUBMIT extension during GEM context creation, an error while processing the next user extension returns without freeing the siblings[] array. A local caller controls both the successful extension and the failing one, so the leak can be driven in a loop and is bounded only by kernel memory. The consequence is unprivileged kernel memory exhaustion on the node - no corruption and no privilege gain described in the record. It is only reachable where an i915 render node is exposed to untrusted code, which on most headless NVIDIA or AMD GPU fleets it is not; it matters on Intel Data Center GPU nodes and on hosts that pass onboard Intel graphics into containers. A node pushed into memory pressure this way has to be drained and rebooted, which is expensive on a GPU host.

Who can reach it

Local user or container with an open i915 /dev/dri render node, repeatedly issuing context-create ioctls with a valid extension followed by a failing one. No elevated privileges required.

What to do

Update to a stable kernel carrying the listed commits and reboot the node. Where an update cannot be scheduled, stop exposing i915 render nodes to untrusted workloads - that removes the reachable path. The record names no fixed release number beyond the stable commits.

References