CVE-2026-74440

Status: UPDATED  |  Advisory ID: CVE-2026-74440

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

drm/xe: Wait on external BO kernel fences in exec IOCTL

Before arming a user job, xe_exec_ioctl() only added the VM's

dma-resv KERNEL slot as a dependency. That slot covers rebinds and

the kernel operations of the VM's private BOs, but not external BOs

(bo->vm == NULL), which carry their kernel operations (evictions,

moves, ...) in their own dma-resv KERNEL slot.

The DMA_RESV_USAGE_KERNEL slot is the cross-driver contract for

memory management operations that must complete before the BO or its

backing store may be used: any accessor is required to wait on the

KERNEL fences before touching the resv. By skipping the external BOs'

KERNEL slots, the exec path violated that contract and could schedule

a user job while a kernel operation on an external BO mapped by the VM

was still in flight, racing against it and potentially reading or

writing memory that was being moved.

Replace the VM-only dependency with an iteration over every object

locked by the exec, adding each object's KERNEL slot as a job

dependency. This covers the VM resv (rebinds and private BOs) as well

as every external BO, mirroring the drm_gpuvm_resv_add_fence() call

that later publishes the job fence to the same set of objects.

Long-running mode continues to skip this, as before.

(cherry picked from commit a6b842acf3ddd1efc53a56de9260cfa718fb35e7) (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References