CVE-2026-80606

Received Received - Intake

Write Lock Notifier in Linux Kernel DRM/XE

Publication date: 2026-08-28

Last updated on: 2026-08-29

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: drm/xe/userptr: Hold notifier_lock for write on inject test path When CONFIG_DRM_XE_USERPTR_INVAL_INJECT=y, xe_pt_svm_userptr_pre_commit() runs vma_check_userptr() with the svm notifier_lock taken for read. The test injection causes vma_check_userptr() to call xe_vma_userptr_force_invalidate(), which feeds into xe_vma_userptr_do_inval() with drm_gpusvm_ctx.in_notifier=true. That flag tells drm_gpusvm_unmap_pages() the caller already holds notifier_lock for write and only asserts the mode. Because the caller actually holds it for read, the assertion fires: WARNING: drivers/gpu/drm/drm_gpusvm.c:1669 at \ drm_gpusvm_unmap_pages+0xd4/0x130 [drm_gpusvm_helper] Call Trace: xe_vma_userptr_do_inval+0x40d/0xfd0 [xe] xe_vma_userptr_invalidate_pass1+0x3e6/0x8d0 [xe] xe_vma_userptr_force_invalidate+0xde/0x290 [xe] vma_check_userptr.constprop.0+0x1c6/0x220 [xe] xe_pt_svm_userptr_pre_commit+0x6a3/0xc60 [xe] ... xe_vm_bind_ioctl+0x3a0a/0x4480 [xe] Acquire notifier_lock for write in pre-commit when the inject Kconfig is enabled, via new helpers xe_pt_svm_userptr_notifier_lock()/_unlock(). Rename xe_svm_assert_held_read() to xe_svm_assert_held_read_or_inject_write() so it asserts the correct mode under each build configuration. Production builds (CONFIG_DRM_XE_USERPTR_INVAL_INJECT=n) keep the existing read-mode behavior bit-for-bit. (cherry picked from commit 80ccbd97ffee8ad2e73167d826fe7be548364365)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-29

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-80606

EUVD

EUVD-2026-67482

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability in the DRM/XE subsystem where a race condition occurs when CONFIG_DRM_XE_USERPTR_INVAL_INJECT is enabled. The issue involves improper locking where a read lock is held but a write lock is required, causing an assertion failure in the GPU memory management code.

Detection Guidance

This vulnerability is specific to the Linux kernel's DRM/XE subsystem and requires CONFIG_DRM_XE_USERPTR_INVAL_INJECT=y to be enabled. Detection involves checking kernel logs for the assertion warning shown in the trace. Use dmesg or journalctl to search for 'WARNING: drivers/gpu/drm/drm_gpusvm.c:1669' or related stack traces involving xe_vma_userptr_do_inval.

Impact Analysis

This vulnerability could lead to system instability or crashes in systems using the affected Linux kernel components. It may cause kernel warnings, unexpected behavior in GPU memory operations, or potential denial-of-service conditions if exploited.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It is a Linux kernel memory management issue in the DRM/XE subsystem that could lead to system instability or crashes under specific test configurations. No evidence suggests it impacts data protection or privacy requirements.

Mitigation Strategies

Disable CONFIG_DRM_XE_USERPTR_INVAL_INJECT in the kernel configuration and rebuild. If this option is not enabled, no action is required as the issue only affects systems with this specific Kconfig option set. Update to a patched kernel version if available.

Hi! I’m here to help you understand CVE-2026-80606. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70