GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80606 (GCVE-0-2026-80606)

Vulnerability from cvelistv5 – Published: 2026-08-28 06:48 – Updated: 2026-08-29 06:21
VLAI
Title
drm/xe/userptr: Hold notifier_lock for write on inject test path
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/xe/userptr: Hold notifier_lock for write on inject test path When CONFIG_DRM_XE_USERPTR_INVAL_INJECT=y, xe_pt_svm_userptr_pre_commit() runs vma_check_userptr() with the svm notifier_lock taken for read. The test injection causes vma_check_userptr() to call xe_vma_userptr_force_invalidate(), which feeds into xe_vma_userptr_do_inval() with drm_gpusvm_ctx.in_notifier=true. That flag tells drm_gpusvm_unmap_pages() the caller already holds notifier_lock for write and only asserts the mode. Because the caller actually holds it for read, the assertion fires: WARNING: drivers/gpu/drm/drm_gpusvm.c:1669 at \ drm_gpusvm_unmap_pages+0xd4/0x130 [drm_gpusvm_helper] Call Trace: xe_vma_userptr_do_inval+0x40d/0xfd0 [xe] xe_vma_userptr_invalidate_pass1+0x3e6/0x8d0 [xe] xe_vma_userptr_force_invalidate+0xde/0x290 [xe] vma_check_userptr.constprop.0+0x1c6/0x220 [xe] xe_pt_svm_userptr_pre_commit+0x6a3/0xc60 [xe] ... xe_vm_bind_ioctl+0x3a0a/0x4480 [xe] Acquire notifier_lock for write in pre-commit when the inject Kconfig is enabled, via new helpers xe_pt_svm_userptr_notifier_lock()/_unlock(). Rename xe_svm_assert_held_read() to xe_svm_assert_held_read_or_inject_write() so it asserts the correct mode under each build configuration. Production builds (CONFIG_DRM_XE_USERPTR_INVAL_INJECT=n) keep the existing read-mode behavior bit-for-bit. (cherry picked from commit 80ccbd97ffee8ad2e73167d826fe7be548364365)
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 9e978741488261e117bb50e5dfcf8e4080990958 , < f9a9abd7bbdab3dfe1b1155e1457dc02b5e14ea5 (git)
Affected: 9e978741488261e117bb50e5dfcf8e4080990958 , < ab9ea5c943c7e780124e75b7ffad9f1c752b2579 (git)
Affected: 9e978741488261e117bb50e5dfcf8e4080990958 , < dca6e08c923a44d2d66b955e03dd57a3a38c2b94 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.18
Unaffected: 0 , < 6.18 (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_pt.c",
            "drivers/gpu/drm/xe/xe_svm.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f9a9abd7bbdab3dfe1b1155e1457dc02b5e14ea5",
              "status": "affected",
              "version": "9e978741488261e117bb50e5dfcf8e4080990958",
              "versionType": "git"
            },
            {
              "lessThan": "ab9ea5c943c7e780124e75b7ffad9f1c752b2579",
              "status": "affected",
              "version": "9e978741488261e117bb50e5dfcf8e4080990958",
              "versionType": "git"
            },
            {
              "lessThan": "dca6e08c923a44d2d66b955e03dd57a3a38c2b94",
              "status": "affected",
              "version": "9e978741488261e117bb50e5dfcf8e4080990958",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_pt.c",
            "drivers/gpu/drm/xe/xe_svm.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/userptr: Hold notifier_lock for write on inject test path\n\nWhen CONFIG_DRM_XE_USERPTR_INVAL_INJECT=y, xe_pt_svm_userptr_pre_commit()\nruns vma_check_userptr() with the svm notifier_lock taken for read. The\ntest injection causes vma_check_userptr() to call\nxe_vma_userptr_force_invalidate(), which feeds into\nxe_vma_userptr_do_inval() with drm_gpusvm_ctx.in_notifier=true. That\nflag tells drm_gpusvm_unmap_pages() the caller already holds\nnotifier_lock for write and only asserts the mode. Because the caller\nactually holds it for read, the assertion fires:\n\n  WARNING: drivers/gpu/drm/drm_gpusvm.c:1669 at \\\n           drm_gpusvm_unmap_pages+0xd4/0x130 [drm_gpusvm_helper]\n  Call Trace:\n   xe_vma_userptr_do_inval+0x40d/0xfd0 [xe]\n   xe_vma_userptr_invalidate_pass1+0x3e6/0x8d0 [xe]\n   xe_vma_userptr_force_invalidate+0xde/0x290 [xe]\n   vma_check_userptr.constprop.0+0x1c6/0x220 [xe]\n   xe_pt_svm_userptr_pre_commit+0x6a3/0xc60 [xe]\n   ...\n   xe_vm_bind_ioctl+0x3a0a/0x4480 [xe]\n\nAcquire notifier_lock for write in pre-commit when the inject Kconfig\nis enabled, via new helpers xe_pt_svm_userptr_notifier_lock()/_unlock().\nRename xe_svm_assert_held_read() to\nxe_svm_assert_held_read_or_inject_write() so it asserts the correct\nmode under each build configuration. Production builds\n(CONFIG_DRM_XE_USERPTR_INVAL_INJECT=n) keep the existing read-mode\nbehavior bit-for-bit.\n\n(cherry picked from commit 80ccbd97ffee8ad2e73167d826fe7be548364365)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through DRM_IOCTL_XE_VM_BIND on a local /dev/dri/renderD* character device; there is no network, adjacent-radio, or physical-bus attack surface on this code path.\nAC:H - Exploitation requires CONFIG_DRM_XE_USERPTR_INVAL_INJECT=y (debug-only Kconfig default n), Intel Xe hardware with drm/xe loaded, and CONFIG_DRM_GPUSVM\u2014rare non-default conditions beyond typical attacker control on production systems.\nPR:L - Any unprivileged local user who can open the DRM render node can create a VM and issue XE_VM_BIND userptr map/remap operations to drive the inject path; root or init-namespace admin rights are not required.\nUI:N - Exploitation requires only attacker-issued GPU bind ioctls against their own VM; no victim user or administrator must perform any separate action.\nS:C - The racy unmap tears down IOMMU/DMA mappings without exclusive notifier_lock, allowing the GPU to access host memory outside the attacker\u0027s intended userptr mapping and crossing the device/kernel memory isolation boundary.\nC:H - Concurrent drm_gpusvm_unmap_pages() under a read notifier_lock races with other userptr/SVM accessors, enabling use-after-free of GPU SVM page state and arbitrary kernel memory disclosure.\nI:H - Unsafe concurrent DMA unmap and pagemap teardown corrupts GPU SVM mapping metadata under weak locking, which can be leveraged for controlled kernel memory writes and code execution.\nA:H - The bug triggers a kernel WARNING/oops via lockdep_assert_held_write() in drm_gpusvm_unmap_pages() and can panic or wedge the Xe driver from unsafe concurrent userptr invalidation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-29T06:21:16.890Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f9a9abd7bbdab3dfe1b1155e1457dc02b5e14ea5"
        },
        {
          "url": "https://git.kernel.org/stable/c/ab9ea5c943c7e780124e75b7ffad9f1c752b2579"
        },
        {
          "url": "https://git.kernel.org/stable/c/dca6e08c923a44d2d66b955e03dd57a3a38c2b94"
        }
      ],
      "title": "drm/xe/userptr: Hold notifier_lock for write on inject test path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80606",
    "datePublished": "2026-08-28T06:48:30.960Z",
    "dateReserved": "2026-08-26T14:34:25.772Z",
    "dateUpdated": "2026-08-29T06:21:16.890Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80606",
      "date": "2026-09-16",
      "epss": "0.00135",
      "percentile": "0.03365"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-80606\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-28T08:16:44.573\",\"lastModified\":\"2026-08-29T07:16:45.633\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/xe/userptr: Hold notifier_lock for write on inject test path\\n\\nWhen CONFIG_DRM_XE_USERPTR_INVAL_INJECT=y, xe_pt_svm_userptr_pre_commit()\\nruns vma_check_userptr() with the svm notifier_lock taken for read. The\\ntest injection causes vma_check_userptr() to call\\nxe_vma_userptr_force_invalidate(), which feeds into\\nxe_vma_userptr_do_inval() with drm_gpusvm_ctx.in_notifier=true. That\\nflag tells drm_gpusvm_unmap_pages() the caller already holds\\nnotifier_lock for write and only asserts the mode. Because the caller\\nactually holds it for read, the assertion fires:\\n\\n  WARNING: drivers/gpu/drm/drm_gpusvm.c:1669 at \\\\\\n           drm_gpusvm_unmap_pages+0xd4/0x130 [drm_gpusvm_helper]\\n  Call Trace:\\n   xe_vma_userptr_do_inval+0x40d/0xfd0 [xe]\\n   xe_vma_userptr_invalidate_pass1+0x3e6/0x8d0 [xe]\\n   xe_vma_userptr_force_invalidate+0xde/0x290 [xe]\\n   vma_check_userptr.constprop.0+0x1c6/0x220 [xe]\\n   xe_pt_svm_userptr_pre_commit+0x6a3/0xc60 [xe]\\n   ...\\n   xe_vm_bind_ioctl+0x3a0a/0x4480 [xe]\\n\\nAcquire notifier_lock for write in pre-commit when the inject Kconfig\\nis enabled, via new helpers xe_pt_svm_userptr_notifier_lock()/_unlock().\\nRename xe_svm_assert_held_read() to\\nxe_svm_assert_held_read_or_inject_write() so it asserts the correct\\nmode under each build configuration. Production builds\\n(CONFIG_DRM_XE_USERPTR_INVAL_INJECT=n) keep the existing read-mode\\nbehavior bit-for-bit.\\n\\n(cherry picked from commit 80ccbd97ffee8ad2e73167d826fe7be548364365)\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/xe/xe_pt.c\",\"drivers/gpu/drm/xe/xe_svm.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"9e978741488261e117bb50e5dfcf8e4080990958\",\"lessThan\":\"f9a9abd7bbdab3dfe1b1155e1457dc02b5e14ea5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9e978741488261e117bb50e5dfcf8e4080990958\",\"lessThan\":\"ab9ea5c943c7e780124e75b7ffad9f1c752b2579\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9e978741488261e117bb50e5dfcf8e4080990958\",\"lessThan\":\"dca6e08c923a44d2d66b955e03dd57a3a38c2b94\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/xe/xe_pt.c\",\"drivers/gpu/drm/xe/xe_svm.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.40\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.1,\"impactScore\":6.0}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/ab9ea5c943c7e780124e75b7ffad9f1c752b2579\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/dca6e08c923a44d2d66b955e03dd57a3a38c2b94\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f9a9abd7bbdab3dfe1b1155e1457dc02b5e14ea5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-09-01T12:40:55+00:00",
      "cve": "CVE-2026-80606",
      "id": "CVE-2026-80606",
      "initial_release_date": "2026-08-28T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/xe/userptr: Hold notifier_lock for write on inject test path",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80606.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-04T00:22:10Z",
      "cve": "CVE-2026-80606",
      "id": "CVE-2026-80606",
      "initial_release_date": "2026-08-28T16:36:33Z",
      "product_status:known_not_affected": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80606",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80606.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.