EUVD-2026-59747
GHSA-7mhj-6hx6-xpjh
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition timing dependency warrants AC:H over vendor's AC:L; PR:L reflects required render group membership for /dev/dri/ access.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
drm/xe: Wait on external BO kernel fences in exec IOCTL
Before arming a user job, xe_exec_ioctl() only added the VM's dma-resv KERNEL slot as a dependency. That slot covers rebinds and the kernel operations of the VM's private BOs, but not external BOs (bo->vm == NULL), which carry their kernel operations (evictions, moves, ...) in their own dma-resv KERNEL slot.
The DMA_RESV_USAGE_KERNEL slot is the cross-driver contract for memory management operations that must complete before the BO or its backing store may be used: any accessor is required to wait on the KERNEL fences before touching the resv. By skipping the external BOs' KERNEL slots, the exec path violated that contract and could schedule a user job while a kernel operation on an external BO mapped by the VM was still in flight, racing against it and potentially reading or writing memory that was being moved.
Replace the VM-only dependency with an iteration over every object locked by the exec, adding each object's KERNEL slot as a job dependency. This covers the VM resv (rebinds and private BOs) as well as every external BO, mirroring the drm_gpuvm_resv_add_fence() call that later publishes the job fence to the same set of objects. Long-running mode continues to skip this, as before.
(cherry picked from commit a6b842acf3ddd1efc53a56de9260cfa718fb35e7)
AnalysisAI
Race condition in the Linux kernel's drm/xe Intel GPU driver allows a locally-authenticated user to schedule a GPU job that executes concurrently with an in-flight kernel memory management operation on an external buffer object, violating the DMA_RESV_USAGE_KERNEL cross-driver synchronization contract. Affected systems are those running Linux 6.8 or later with compatible Intel Xe-architecture GPU hardware and the xe driver loaded; the race can result in reading or writing memory that is simultaneously being evicted or relocated. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) Local system access with a user account that has read/write permission to /dev/dri/renderD* - typically users in the Linux 'render' or 'video' group; (2) Intel Xe-architecture GPU hardware present in the system with the xe kernel driver loaded and active (not the older i915 driver); (3) the ability to map external buffer objects (bo->vm == NULL) through a VM context, which is normal drm/xe API behavior but requires kernel versions from 6.8 through the unpatched range. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 7.8 with AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H places this as a High-severity local privilege-escalation class vulnerability, but several signals temper the urgency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local user with membership in the 'render' group on a Linux system with an Intel Xe GPU allocates a shared external buffer object imported into a VM context via the xe driver. The attacker then triggers system memory pressure (e.g., by allocating large amounts of memory) to provoke a kernel eviction operation on the external BO, while simultaneously submitting a crafted exec IOCTL that references the same BO - causing the GPU job to execute while the kernel is relocating the BO's backing store, enabling the GPU to read from or write to the memory being moved. … |
| Remediation | Upgrade to a patched kernel: Linux 7.1.8, 6.12.103, or 6.18.44 for stable branches, or 7.2-rc3 for mainline preview. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and document all systems running Linux 6.8 or later with Intel Xe GPU drivers, prioritizing GPU-accelerated workloads in data science and compute clusters. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today