Description

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Wait on external BO kernel fences in exec IOCTL Before arming a user job, xe_exec_ioctl() only added the VM's dma-resv KERNEL slot as a dependency. That slot covers rebinds and the kernel operations of the VM's private BOs, but not external BOs (bo->vm == NULL), which carry their kernel operations (evictions, moves, ...) in their own dma-resv KERNEL slot. The DMA_RESV_USAGE_KERNEL slot is the cross-driver contract for memory management operations that must complete before the BO or its backing store may be used: any accessor is required to wait on the KERNEL fences before touching the resv. By skipping the external BOs' KERNEL slots, the exec path violated that contract and could schedule a user job while a kernel operation on an external BO mapped by the VM was still in flight, racing against it and potentially reading or writing memory that was being moved. Replace the VM-only dependency with an iteration over every object locked by the exec, adding each object's KERNEL slot as a job dependency. This covers the VM resv (rebinds and private BOs) as well as every external BO, mirroring the drm_gpuvm_resv_add_fence() call that later publishes the job fence to the same set of objects. Long-running mode continues to skip this, as before. (cherry picked from commit a6b842acf3ddd1efc53a56de9260cfa718fb35e7)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-15T13:17:48.540Z",
  "pubdate": "2026-08-15T13:17:48.540Z",
  "executiveSummary": "A synchronization vulnerability exists within the Linux kernel DRM subsystem specifically affecting the xe driver. The flaw arises in xe_exec_ioctl() when handling external buffer objects during execution command ioctl processing. Due to missing dependency tracking for external buffer objects, the kernel violates cross-driver memory management contracts by failing to wait on essential KERNEL slot fences. This omission allows user-submitted jobs to be scheduled while concurrent kernel operations such as evictions or memory relocations are still in flight.\nThe primary impact of this vulnerability is a race condition between user jobs and asynchronous kernel memory management operations on external buffer objects. This can lead to memory corruption, unauthorized data read or write capabilities, and potential system instability or local privilege escalation. The vulnerability affects systems utilizing the Linux kernel with the drm/xe graphics driver enabled. Exploitation requires local access to the system and the ability to execute code that interacts with the DRI/DRM subsystem via ioctl interfaces, allowing an attacker to manipulate shared buffer objects and race against ongoing kernel memory migrations.",
  "technicalDetails": "The vulnerability resides in the xe_exec_ioctl() function of the drm/xe driver within the Linux kernel. The root cause is the failure to incorporate the DMA_RESV_USAGE_KERNEL slots of external buffer objects (where bo->vm == NULL) into the job dependency chain prior to arming a user execution job. Previously, the driver only registered the virtual machine's dma-resv KERNEL slot as a dependency, which covers rebinds and private buffer object operations but completely omits external buffer objects mapped by the virtual machine.\nThe DMA_RESV_USAGE_KERNEL slot serves as the cross-driver synchronization contract mandated by the kernel memory management subsystem. Any accessor interacting with a buffer object or its backing store is strictly required to wait upon these KERNEL fences before touching the reservation object. By bypassing this check for external buffer objects, the execution path schedules user workloads while background memory management tasks—such as evictions, moves, and remappings managed by independent KERNEL slots—are actively in-flight.\nThe attack flow proceeds as follows: An attacker allocates or interacts with external buffer objects shared or mapped within a virtual machine context. Through ioctl operations, the attacker triggers memory management actions (like backing store migrations or evictions) that populate the external buffer object's KERNEL dma-resv slot. Simultaneously, the attacker submits a user execution job via xe_exec_ioctl(). Because the driver fails to query and wait upon the KERNEL fences of the external buffer objects, the scheduler dispatches the user job immediately. The user job executes concurrently with the kernel's in-flight memory movement operations, leading to a classic time-of-check to time-of-use (TOCTOU) race condition and memory corruption as the GPU reads or writes to memory locations that are actively being relocated or invalidated.\nThe vulnerability requires local execution privileges to interact with the device nodes associated with the drm/xe driver. No network exposure is involved as the attack surface is restricted to local system calls via the ioctl interface. Long-running execution modes are noted to skip this dependency check as part of their design and are handled separately, though the core vulnerability impacts standard execution paths where synchronization is erroneously omitted."
}