Linux kernel drm/xe: stale GPU data can persist in L1 dataport cache when memory is reclaimed

Impact

The Xe driver's render cache flush requested an HDC pipeline flush but never the untyped L1 dataport cache flush. On MTL and later the hardware no longer couples those two, so dirty lines could survive in the L1 dataport cache when GPU memory was reclaimed or evicted - meaning data from one GPU context can be readable by whatever is handed that memory next. On an Intel GPU node shared between tenants or between jobs, that is a cross-context residual-data exposure rather than a crash. The fix sets the untyped dataport flush bit alongside the HDC flush, restricted to GRAPHICS_VERx100 >= 2000 (Xe2 and later) because the kernel cannot reliably request it on MTL; pre-MTL parts are unaffected because HDC_CHICKEN0 programming kept the flushes coupled. No CVSS score or CWE is in the record.

Who can reach it

Local user with access to an Intel GPU device node (a tenant with a GPU pod or any process holding /dev/dri/render*) on Xe2-class or later hardware. No remote path; requires being scheduled on the same GPU as the victim workload.

What to do

Update to a stable kernel containing the drm/xe fix and reboot the affected Intel GPU nodes - the change is in the command-stream flush path, so a module reload is not a safe substitute on a node with live workloads. The record gives only stable commit hashes, no fixed version numbers. Nodes on pre-MTL Intel graphics need no action.

References

Related entries

• Linux kernel drm_exec: empty object array leaves contention unresolved and spins foreverCVE-2026-97900 · Linux kernel drm_exec (drm_exec_prepare_array with num_objects == 0)Unscored
• Linux kernel accel/qaic: unbounded response message walk in resp_worker() reads past the slab allocationCVE-2026-98155 · Linux kernel accel/qaic (Qualcomm Cloud AI 100 accelerator driver)Unscored
• GPU / accelerator firmware (VBIOS, GSP, NVSwitch): GPU-resident firmware sits below the host OS and is not coveredNCVD-0000-012-gpu-accelerator-firmware-vbios-g · GPU / accelerator firmware (VBIOS, GSP, NVSwitch)Unscored
• NVIDIA Multi-Instance GPU (MIG) partitioning: MIG gives each instance its own SM slice, L2 slice, memory slice andNCVD-2020-001-nvidia-multi-instance-gpu-mig-pa · NVIDIA Multi-Instance GPU (MIG) partitioningUnscored
• NVIDIA Multi-Instance GPU (MIG) partitioning: MIG gives each instance its own SM slice, L2 slice, memory slice andNCVD-2020-003-nvidia-multi-instance-gpu-mig-pa · NVIDIA Multi-Instance GPU (MIG) partitioningUnscored
• Integrated GPU graphics data compression (Intel, AMD, Apple, Arm, Qualcomm, NVIDIA): GPUs apply data-dependent losslessNCVD-2023-003-integrated-gpu-graphics-data-com · Integrated GPU graphics data compression (Intel, AMD, Apple, Arm, Qualcomm, NVIDIA)Unscored