{"id":"CVE-2026-98391","revision":"dc1b3c8afe6148fb8029b16db0c96696","records":[{"revision":"dc1b3c8afe6148fb8029b16db0c96696","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-98391","aliases":[],"title":"drm/xe: Guard page-fault worker with runtime PM check","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Guard page-fault worker with runtime PM check\n\nDuring VM teardown, the VM's runtime PM reference is dropped\nasynchronously, allowing the device to autosuspend while stale page\nfaults belonging to the now-dead VM are still queued. When the\npage-fault worker later tries to ack one of these, it calls into\nguc_ct_send_locked() on an already-suspended device, tripping:\n\n\u00A0 Assertion `!xe_pm_runtime_suspended(xe)` failed!\n\u00A0 WARNING at xe_device.c:1267 xe_device_assert_mem_access+0x11c/0x140 [xe]\n\nA live VM/exec queue always holds a PM reference while it has\noutstanding work, so if the device is suspended at ack time, the\nowning context is already gone and the fault is stale.\n\nTake a runtime PM reference across the entire pagefault\nqueue worker to safely deliver acks for torn-down VMs.\n\nv3:\n - Move PM ref to the generic xe_pagefault_queue_work using\n   guard(xe_pm_runtime)(xe) instead of tracking it in the GuC\n   backend(Matt Brost).\n\nv2:\n - Hold PM ref across the entire batch (begin/end) instead of per-ack.\n   This prevents the device from autosuspending mid-batch, which would\n   leave write_only acks written but the end flush skipped, and skip\n   counter++, desyncing the cadence check.(Himal)\n - Add a comment explaining stale faults.(Himal)\n\n(cherry picked from commit fcc2431d2213dc4d04250c4f1ae87d9c3ae0d455)\n[Rodrigo: Added xe_device struct for compatibility while cherry-picking]","state":0,"publishedAt":"2026-10-14T13:25:55.498+00:00","modifiedAt":"2026-10-19T09:18:42.391+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/gpu/drm/xe/xe_pagefault.c\",\n                        \"drivers/gpu/drm/xe/xe_pagefault_types.h\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"f289f7807119128d4f9d59f34ac557549c7562e5\",\n                            \"lessThan\": \"25764620ec64c0142e2c87c41787f45540cf09ff\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f289f7807119128d4f9d59f34ac557549c7562e5\",\n                            \"lessThan\": \"20fce5b34b21a995839743b4917a1edd2fd503ba\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/gpu/drm/xe/xe_pagefault.c\",\n                        \"drivers/gpu/drm/xe/xe_pagefault_types.h\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.19\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.19\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.7\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/25764620ec64c0142e2c87c41787f45540cf09ff","https://git.kernel.org/stable/c/20fce5b34b21a995839743b4917a1edd2fd503ba"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98391","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98391","identifiers":["CVE-2026-98391"]},"retained":false,"historicalAffected":[]}],"coverage":[]}