PT-2026-114370 · Linux · Linux
CVE-2026-98391
·
Publicado
2026-10-14
·
Atualizado
2026-10-14
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
drm/xe: Guard page-fault worker with runtime PM check
During VM teardown, the VM's runtime PM reference is dropped
asynchronously, allowing the device to autosuspend while stale page
faults belonging to the now-dead VM are still queued. When the
page-fault worker later tries to ack one of these, it calls into
guc ct send locked() on an already-suspended device, tripping:
Assertion
!xe pm runtime suspended(xe) failed!
WARNING at xe device.c:1267 xe device assert mem access+0x11c/0x140 [xe]A live VM/exec queue always holds a PM reference while it has
outstanding work, so if the device is suspended at ack time, the
owning context is already gone and the fault is stale.
Take a runtime PM reference across the entire pagefault
queue worker to safely deliver acks for torn-down VMs.
v3:
- Move PM ref to the generic xe pagefault queue work using guard(xe pm runtime)(xe) instead of tracking it in the GuC backend(Matt Brost).
v2:
- Hold PM ref across the entire batch (begin/end) instead of per-ack. This prevents the device from autosuspending mid-batch, which would leave write only acks written but the end flush skipped, and skip counter++, desyncing the cadence check.(Himal)
- Add a comment explaining stale faults.(Himal)
(cherry picked from commit fcc2431d2213dc4d04250c4f1ae87d9c3ae0d455)
[Rodrigo: Added xe device struct for compatibility while cherry-picking]
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux