Linux kernel drm/xe VF: CCS batch buffers attached/detached without waiting for in-flight BO copy
Impact
On Intel Xe GPUs used in SR-IOV mode, xe_bo_move() attached the VF compression (CCS) read/write batch buffers after submitting the copy job and detached them before the blit had signalled. A VF migration event that pauses the guest mid-copy can therefore observe partially copied CCS metadata with no attach state, or race the save/restore path against a still-running blit whose batch buffers have already been torn down. On a node where GPU partitions are handed to separate tenants, this is memory-state corruption around a tenant boundary during live migration, with memory corruption or a GPU/driver crash as the realistic outcome. The same commit also fixes xe_sriov_vf_ccs_attach_bo() silently discarding per-context attach failures.
Who can reach it
Local, on a host running drm/xe with SR-IOV virtual functions. No remote path: triggering requires driving GPU buffer-object moves while a VF migration event occurs. A tenant holding an Xe VF can generate the BO traffic; the migration event itself is operator-initiated.
What to do
Take the stable kernel fix (commits in the record) and reboot each affected GPU node; there is no module-reload path for a driver bound to live GPU workloads. Nodes that do not enable Xe SR-IOV VFs are not affected and can be patched on the normal cycle.
References
Related entries
- Linux kernel vmwgfx: surface array_size taken from userspace without a shader-model boundCVE-2026-68446 · Linux kernel drm/vmwgfx (vmw_surface_metadata::array_size validation)High
- Linux kernel dma-fence: zero-count dedup returns 1, letting amdgpu user-queue waits read an uninitialized fenceCVE-2026-72095 · Linux kernel dma-fence (dma_fence_dedup_array zero-count handling, amdgpu user queues)High
- NVIDIA/Mellanox ConnectX driver (mlx5_ib user access region index release): The driver released the software-side UARCVE-2026-74296 · NVIDIA/Mellanox ConnectX driver (mlx5_ib user access region index release)High
- Linux kernel amdgpu RAS / GPU reset and recovery path (drm/amdgpu): An out-of-bounds access in the amdgpu RAS / GPUCVE-2026-74357 · Linux kernel amdgpu RAS / GPU reset and recovery path (drm/amdgpu)High
- Linux kernel vmwgfx: undersized DRAW_PRIMITIVES header wraps the bound into an out-of-bounds readCVE-2026-74444 · Linux kernel drm/vmwgfx (vmw_cmd_draw DRAW_PRIMITIVES header size)High
- Linux kernel amdgpu display core (DC/DM) (drm/amd/display): An out-of-bounds access in the amdgpu display core (DC/DM)CVE-2026-74449 · Linux kernel amdgpu display core (DC/DM) (drm/amd/display)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.