CVE-2026-23466 (GCVE-0-2026-23466)
Vulnerability from cvelistv5
Published
2026-04-03 15:15
Modified
2026-08-05 12:22
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Open-code GGTT MMIO access protection GGTT MMIO access is currently protected by hotplug (drm_dev_enter), which works correctly when the driver loads successfully and is later unbound or unloaded. However, if driver load fails, this protection is insufficient because drm_dev_unplug() is never called. Additionally, devm release functions cannot guarantee that all BOs with GGTT mappings are destroyed before the GGTT MMIO region is removed, as some BOs may be freed asynchronously by worker threads. To address this, introduce an open-coded flag, protected by the GGTT lock, that guards GGTT MMIO access. The flag is cleared during the dev_fini_ggtt devm release function to ensure MMIO access is disabled once teardown begins. (cherry picked from commit 4f3a998a173b4325c2efd90bdadc6ccd3ad9a431)
References
Impacted products
Vendor Product Version
Linux Linux Version: 919bb54e989c1edef87e9797be125c94c450fc65
Version: 919bb54e989c1edef87e9797be125c94c450fc65
Version: 919bb54e989c1edef87e9797be125c94c450fc65
Version: 919bb54e989c1edef87e9797be125c94c450fc65
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_ggtt.c",
            "drivers/gpu/drm/xe/xe_ggtt_types.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e2b424aadecb640f9e037b2891191cf8fd4c64cf",
              "status": "affected",
              "version": "919bb54e989c1edef87e9797be125c94c450fc65",
              "versionType": "git"
            },
            {
              "lessThan": "1e9e2640d870d4837bcfdc220cb2c99ae5ee119f",
              "status": "affected",
              "version": "919bb54e989c1edef87e9797be125c94c450fc65",
              "versionType": "git"
            },
            {
              "lessThan": "76326dc06d8793c2c81c31cc0115dbc348de2f88",
              "status": "affected",
              "version": "919bb54e989c1edef87e9797be125c94c450fc65",
              "versionType": "git"
            },
            {
              "lessThan": "01f2557aa684e514005541e71a3d01f4cd45c170",
              "status": "affected",
              "version": "919bb54e989c1edef87e9797be125c94c450fc65",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_ggtt.c",
            "drivers/gpu/drm/xe/xe_ggtt_types.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.20",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.78",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.20",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.10",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Open-code GGTT MMIO access protection\n\nGGTT MMIO access is currently protected by hotplug (drm_dev_enter),\nwhich works correctly when the driver loads successfully and is later\nunbound or unloaded. However, if driver load fails, this protection is\ninsufficient because drm_dev_unplug() is never called.\n\nAdditionally, devm release functions cannot guarantee that all BOs with\nGGTT mappings are destroyed before the GGTT MMIO region is removed, as\nsome BOs may be freed asynchronously by worker threads.\n\nTo address this, introduce an open-coded flag, protected by the GGTT\nlock, that guards GGTT MMIO access. The flag is cleared during the\ndev_fini_ggtt devm release function to ensure MMIO access is disabled\nonce teardown begins.\n\n(cherry picked from commit 4f3a998a173b4325c2efd90bdadc6ccd3ad9a431)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable GGTT removal path is in the local Intel xe DRM driver teardown/probe-failure path, reached through local device/driver activity rather than network or adjacent input.\nAC:L - Once a probe-failure or teardown window exists with GGTT-mapped BO cleanup pending, the stale MMIO access follows from deterministic cleanup ordering; repeated local attempts can trigger the condition.\nPR:L - The path is local and tied to DRM/driver resources; although forcing probe failure may require stronger controls in some deployments, local DRM access and cleanup are involved, so Low is the higher defensible choice under the uncertainty rule.\nUI:N - No separate victim action is required after the local attacker triggers the driver/probe/cleanup sequence.\nS:U - The impact remains within the local kernel/driver security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - The bug is stale GGTT MMIO access after teardown, a use-after-unmap style memory corruption condition; under the required overestimation rule, such corruption is treated as potentially enabling broader kernel information disclosure.\nI:H - The vulnerable operation writes GGTT PTEs through a stale MMIO mapping after it may have been removed, so it can plausibly corrupt kernel or device state and is scored as high integrity impact.\nA:H - The observed failure mode is a kernel page fault/oops in `xe_ggtt_set_pte()` from `ggtt_node_remove_work_func()`, causing a kernel crash or severe availability loss."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:22:01.599Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e2b424aadecb640f9e037b2891191cf8fd4c64cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/1e9e2640d870d4837bcfdc220cb2c99ae5ee119f"
        },
        {
          "url": "https://git.kernel.org/stable/c/76326dc06d8793c2c81c31cc0115dbc348de2f88"
        },
        {
          "url": "https://git.kernel.org/stable/c/01f2557aa684e514005541e71a3d01f4cd45c170"
        }
      ],
      "title": "drm/xe: Open-code GGTT MMIO access protection",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23466",
    "datePublished": "2026-04-03T15:15:45.754Z",
    "dateReserved": "2026-01-13T15:37:46.021Z",
    "dateUpdated": "2026-08-05T12:22:01.599Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.