CVE-2026-98521

Received Received - Intake

RCU Grace Period Issue in Linux Kernel i915 Driver

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: drm/i915: fix incorrect RCU teardown order i915_gem_busy_ioctl uses dma_resv_for_each_fence_unlocked() to iterate over the fences in an GEM object without holding a reference but only the RCU read side lock. What can happen here is that the GEM object is destroyed concurrently while i915_gem_busy_ioctl is still running. This won't free the GEM objects memory, but still drops all the dma_fence references. Now when dma_resv_for_each_fence_unlocked() sees a destroyed dma_fence it assumes that a new fence list was installed and re-starts the loop. But in the case of a destroyed GEM object a new fence list is never installed, only the old one freed and therefore the iteration never finishes resulting in an endless loop. The solution is to drop the fence references only after the RCU grace period. The fixes tag is not necessary the patch introducing the problem, but the one making it so worse that we need to address it. This problem was pointed out by Sashiko-bot. (cherry picked from commit 5113479556025093bf8133bb2dcaa33be2d50921)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98521

EUVD

EUVD-2026-103761

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	912ff2ebd695c582ca4cebf833ad73a378a99f23
Linux	Linux	912ff2ebd695c582ca4cebf833ad73a378a99f23
Linux	Linux	912ff2ebd695c582ca4cebf833ad73a378a99f23
Linux	Linux	912ff2ebd695c582ca4cebf833ad73a378a99f23
Linux	Linux	912ff2ebd695c582ca4cebf833ad73a378a99f23
Linux	Linux	912ff2ebd695c582ca4cebf833ad73a378a99f23
Linux	Linux	5.17

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves an incorrect RCU (Read-Copy-Update) teardown order in the i915 graphics driver. The issue occurs in the i915_gem_busy_ioctl function, which iterates over fences in a GEM object without holding a proper reference. If the GEM object is destroyed while the function is still running, it can lead to an endless loop because the fence iteration never completes.

Detection Guidance

This vulnerability is specific to the Linux kernel's i915 graphics driver and may cause system hangs due to an endless loop in fence iteration. Detection requires checking kernel logs for system freezes or high CPU usage in graphics-related processes. Commands like 'dmesg | grep -i i915' or 'journalctl -k | grep -i i915' may show related errors.

Impact Analysis

This vulnerability could cause system hangs or unresponsiveness if the endless loop consumes excessive CPU resources. It may lead to denial-of-service conditions where the affected system becomes sluggish or completely unresponsive.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a kernel-level issue related to memory management and fence iteration in the Linux kernel. Compliance impacts would only occur if exploitation led to system instability or denial of service, which is not specified in the provided context.

Mitigation Strategies

Apply the latest kernel update from your Linux distribution to patch the i915 driver issue. If immediate patching is not possible, consider disabling the i915 module temporarily or restricting access to graphics-intensive applications until the fix is applied.

Hi! I’m here to help you understand CVE-2026-98521. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70