Linux kernel drm/xe: memory leak when hang replay state is set twice on an exec queue
Impact
exec_queue_set_hang_replay_state() overwrites q->replay_state without checking whether a buffer from a prior vmemdup_user() is already there, leaking that allocation. A local process holding an xe DRM device node can repeat the call to leak kernel memory until the node is under memory pressure - a denial of service against the whole machine, not just the caller, on a node whose GPUs are shared. This is the Intel Xe driver, so it applies to fleets running Intel datacenter GPUs (Max/Flex series) rather than NVIDIA or AMD parts. The record describes a leak only; there is no claim of corruption or privilege escalation.
Who can reach it
Local user with access to an Intel Xe DRM render node (/dev/dri/renderD*) - which is exactly what a GPU tenant container is given. No special privilege beyond device access is needed.
What to do
Apply the stable fix, which returns an error when q->replay_state is already populated; two stable commits are listed. Deployment is a kernel or DRM-module update - on most distributions that means a new kernel package and a node reboot, with GPU workloads drained first, since the xe module cannot be reloaded while tenant contexts hold the device.
References
Related entries
- Linux kernel AMD XDNA driver: unprivileged mmap plus MADV_DONTNEED trips a BUG_ONCVE-2026-74716 · Linux kernel accel/amdxdna (AMD XDNA NPU driver, amdxdna_insert_pages)Unscored
- Linux kernel AMD XDNA driver: error path closes a live VMA and underflows its referencesCVE-2026-74721 · Linux kernel accel/amdxdna (amdxdna_insert_pages error paths call vm_ops->close)Unscored
- GPU / accelerator firmware (VBIOS, GSP, NVSwitch): GPU-resident firmware sits below the host OS and is not coveredNCVD-0000-012-gpu-accelerator-firmware-vbios-g · GPU / accelerator firmware (VBIOS, GSP, NVSwitch)Unscored
- NVIDIA Multi-Instance GPU (MIG) partitioning: MIG gives each instance its own SM slice, L2 slice, memory slice andNCVD-2020-001-nvidia-multi-instance-gpu-mig-pa · NVIDIA Multi-Instance GPU (MIG) partitioningUnscored
- NVIDIA Multi-Instance GPU (MIG) partitioning: MIG gives each instance its own SM slice, L2 slice, memory slice andNCVD-2020-003-nvidia-multi-instance-gpu-mig-pa · NVIDIA Multi-Instance GPU (MIG) partitioningUnscored
- Integrated GPU graphics data compression (Intel, AMD, Apple, Arm, Qualcomm, NVIDIA): GPUs apply data-dependent losslessNCVD-2023-003-integrated-gpu-graphics-data-com · Integrated GPU graphics data compression (Intel, AMD, Apple, Arm, Qualcomm, NVIDIA)Unscored
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.