Linux kernel drm/xe: SVM state and pagemaps leak on the xe_vm_create() error path
Impact
xe_svm_init() became unconditional in xe_vm_create(), but the error unwind after a drm_gpuvm_resv_object_alloc() failure still calls xe_svm_fini() only for fault-mode VMs. Non-fault-mode VMs leave vm->svm.gpusvm partially initialised and leak everything drm_gpusvm_init() allocated; fault-mode VMs additionally leak the pagemap owner and pagemaps, which are released by xe_svm_close() and not called here either. The exposure is kernel memory exhaustion driven by repeated failing VM creations from a tenant, which degrades and eventually destabilises a shared GPU node. No corruption or disclosure primitive is described.
Who can reach it
Local user with an Xe render node who can repeatedly call VM create under memory pressure so the resv-object allocation fails. No authentication beyond device access.
What to do
Apply the stable fix that calls xe_svm_close()/xe_svm_fini() unconditionally on the error path, and reboot the node. Leaked memory from prior occurrences is only reclaimed by a reboot.
References
Related entries
- Linux kernel drm/xe VF: NULL dereference detaching CCS buffers after the device is unboundCVE-2026-68305 · Linux kernel drm/xe SR-IOV VF CCS buffer detach (xe_sriov_vf_ccs_detach_bo)High
- Linux kernel drm/xe GuC: async exec queue destruction can deadlock drmm cleanup on device removalCVE-2026-68382 · Linux kernel drm/xe GuC exec queue teardown (device reference lifetime)High
- Linux kernel drm/xe GuC: scheduler keeps a pointer to the exec queue name freed with the queueCVE-2026-68383 · Linux kernel drm/xe GuC submission (scheduler timeline name)High
- Linux kernel drm/xe VF: CCS batch buffers attached/detached without waiting for in-flight BO copyCVE-2026-68384 · Linux kernel drm/xe SR-IOV VF (CCS metadata batch buffers on BO move)High
- Linux kernel vmwgfx: surface array_size taken from userspace without a shader-model boundCVE-2026-68446 · Linux kernel drm/vmwgfx (vmw_surface_metadata::array_size validation)High
- Linux kernel dma-fence: zero-count dedup returns 1, letting amdgpu user-queue waits read an uninitialized fenceCVE-2026-72095 · Linux kernel dma-fence (dma_fence_dedup_array zero-count handling, amdgpu user queues)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.