CVE-2026-80606

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/userptr: Hold notifier lock for write on inject test path

When CONFIG DRM XE USERPTR INVAL INJECT=y, xe pt svm userptr pre commit() runs vma check userptr() with the svm notifier lock taken for read. The test injection causes vma check userptr() to call xe vma userptr force invalidate(), which feeds into xe vma userptr do inval() with drm gpusvm ctx.in notifier=true. That flag tells drm gpusvm unmap pages() the caller already holds notifier lock for write and only asserts the mode. Because the caller actually holds it for read, the assertion fires:

WARNING: drivers/gpu/drm/drm gpusvm.c:1669 at drm gpusvm unmap pages+0xd4/0x130 [drm gpusvm helper] Call Trace: xe vma userptr do inval+0x40d/0xfd0 [xe] xe vma userptr invalidate pass1+0x3e6/0x8d0 [xe] xe vma userptr force invalidate+0xde/0x290 [xe] vma check userptr.constprop.0+0x1c6/0x220 [xe] xe pt svm userptr pre commit+0x6a3/0xc60 [xe] ... xe vm bind ioctl+0x3a0a/0x4480 [xe]

Acquire notifier lock for write in pre-commit when the inject Kconfig is enabled, via new helpers xe pt svm userptr notifier lock()/ unlock(). Rename xe svm assert held read() to xe svm assert held read or inject write() so it asserts the correct mode under each build configuration. Production builds (CONFIG DRM XE USERPTR INVAL INJECT=n) keep the existing read-mode behavior bit-for-bit.

(cherry picked from commit 80ccbd97ffee8ad2e73167d826fe7be548364365)