Linux Kernel EUVD-2026-25440

The vulnerability resides in the drm/xe kernel module, which is the DRM driver for Intel Xe-architecture GPUs including Intel Arc discrete graphics (Alchemist/Battlemage) and Meteor Lake and later integrated graphics. The ccs_mode sysfs attribute controls Color Compression Surface (CCS) modes and is writable by users with appropriate permissions. When the store handler calls xe_gt_reset() to apply a new CCS mode, xe_gt_reset() internally calls xe_pm_runtime_get_noresume() (xe_pm.c:885), which is a non-blocking PM get that asserts the caller already holds an outer runtime PM reference. Without that outer reference, the GPU device could transition to a low-power suspended state mid-reset, causing undefined behavior and a kernel WARN_ON. The root cause is a missing scope-based runtime PM guard around the xe_gt_reset() call. CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* covers all Linux versions with this driver present; the xe driver was upstreamed in kernel 6.2 and the bug exists in the range 480b358e7d8ef69fd8f1b0cad6e07c7d70a36ee4 up to the respective fix commits. No CWE is formally assigned, but this maps conceptually to CWE-667 (Improper Locking) or CWE-362 (Race Condition) due to improper serialization of PM lifecycle with device operations.