GPU VulnDB

Database/NVIDIA / GPU stack

Linux kernel drm/xe: flat CCS storage published as usable VRAM, corrupting allocations

CVSS 7.8CVE-2026-90047NVIDIA / GPU stackcurated

Impact

get_flat_ccs_offset() rounded the flat CCS base address up to 128K before treating everything below it as usable VRAM, so when the hardware base is not 128K aligned the driver hands the tail of a CCS page to the VRAM allocator. The compression hardware then overwrites whatever landed there, with no page-table entry, buffer object or GPU submission involved - on a Battlemage G21 with 16 GiB it clobbered a page table and broke the display stack on every cold boot. The damaged assertion that should have caught it could not fail and was compiled out without CONFIG_DRM_XE_DEBUG. The record gives no attacker-controlled path; the demonstrated effect is silent memory corruption of whatever the allocator places on that page. Relevant only where Intel Xe-class GPUs are deployed, which is a minority of accelerator fleets.

Who can reach it

Local, on a host running the xe driver with an affected Intel GPU whose scaled CCS base is not 128K aligned. No authentication step is described - the corruption occurs from driver initialisation onward, before userspace exists.

What to do

Take the stable kernel with commits 348c3db4f152 / 818bebeb63dd / c96477e0cabf, which rounds the offset down to page size instead of up and replaces the dead assertion with one that can fire. Applying it requires draining and rebooting each affected node. No mitigation short of the patch is described.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-90047https://git.kernel.org/stable/c/348c3db4f1520d36764ac8cae2492f50599714f6https://git.kernel.org/stable/c/818bebeb63dd6bf5f4e07e145f6cdbace520a34chttps://git.kernel.org/stable/c/c96477e0cabf55bfbdf078078e9de1c8024f8060

Related entries

All NVIDIA / GPU stack entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.