CVE-2026-31547: Linux Kernel Privilege Escalation Flaw

CVE-2026-31547 Overview

CVE-2026-31547 affects the Linux kernel's drm/xe graphics driver. The flaw exists in ccs_mode_store(), which calls xe_gt_reset() without holding an outer runtime power management (PM) reference. The function xe_pm_runtime_get_noresume() requires the caller to already hold such a reference and emits a kernel warning when none is held. A local user with sufficient privileges to access the affected sysfs interface can trigger the missing protection, leading to availability impact on the graphics subsystem.

Critical Impact
Local users can trigger a runtime PM reference violation in the Intel Xe graphics driver, producing kernel warnings and potential GPU instability through the ccs_mode_store sysfs interface.

Affected Products

Linux Kernel 6.19
Linux Kernel 7.0 release candidates (rc1 through rc7)
Systems using the Intel Xe DRM driver (drm/xe)

Discovery Timeline

2026-04-24 - CVE-2026-31547 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-31547

Vulnerability Analysis

The vulnerability resides in the ccs_mode_store() function within the Intel Xe DRM driver. When a user writes to the corresponding sysfs attribute, ccs_mode_store() invokes xe_gt_reset() to reset the GPU tile. xe_gt_reset() internally calls xe_pm_runtime_get_noresume(), a helper that increments the runtime PM usage count without resuming the device. This helper assumes the caller already holds an outer runtime PM reference.

Because ccs_mode_store() did not acquire such a reference before calling into the reset path, the kernel emitted a warning at drivers/gpu/drm/xe/xe_pm.c:885:

xe 0000:03:00.0: [drm] Missing outer runtime PM protection

The fix wraps the call site with the scope-based guard(xe_pm_runtime)(xe) macro. This ensures the runtime PM reference is acquired before xe_gt_reset() runs and is automatically released when the scope exits.

Root Cause

The root cause is a missing runtime PM reference acquisition before invoking a code path that requires one. The contract for xe_pm_runtime_get_noresume() requires callers to hold an outer reference. ccs_mode_store() violated this contract, leaving the runtime PM state inconsistent during GPU tile reset operations.

Attack Vector

Exploitation requires local access with privileges to write the ccs_mode sysfs attribute exposed by the Xe driver. Network exploitation is not possible. A local user triggers the path by writing to the attribute, which initiates a GPU reset without proper power management protection. The result is a kernel warning and potential availability impact on the graphics subsystem. There is no confidentiality or integrity impact.

The vulnerability mechanism is described in the upstream commits. See the kernel commit c409ecce9adc and kernel commit 65d046b2d8e0 for the full patch.

Detection Methods for CVE-2026-31547

Indicators of Compromise

Kernel log entries containing Missing outer runtime PM protection from the xe driver
WARNING messages referencing xe_pm_runtime_get_noresume+0x8b/0xc0 in dmesg or journalctl output
Unexpected GPU resets correlated with writes to the ccs_mode sysfs attribute

Detection Strategies

Monitor dmesg and journalctl -k for warnings originating from drivers/gpu/drm/xe/xe_pm.c
Audit running kernel versions against the affected range (6.19 and 7.0-rc1 through 7.0-rc7) on systems with Intel Xe-supported GPUs
Track sysfs write events to /sys/class/drm/.../ccs_mode using audit rules

Monitoring Recommendations

Forward kernel warnings to a centralized log platform and alert on the specific xe_pm warning signature
Inventory hosts running affected kernel builds, prioritizing workstations and servers with Intel discrete or integrated graphics using the Xe driver
Review user activity on multi-user systems for unauthorized writes to GPU control sysfs paths

How to Mitigate CVE-2026-31547

Immediate Actions Required

Update the Linux kernel to a version containing commits c409ecce9adc or 65d046b2d8e0, which apply the scope-based guard(xe_pm_runtime)(xe) fix
Restrict write access to ccs_mode sysfs attributes to administrators only on multi-user systems
Identify and patch all systems running kernel 6.19 or 7.0 release candidates that use the Xe driver

Patch Information

The upstream fix is cherry-picked from commit 7937ea733f79b3f25e802a0c8360bf7423856f36. Stable backports are available at the kernel commit c409ecce9adc and kernel commit 65d046b2d8e0. Apply distribution-provided kernel updates as they become available.

Workarounds

Limit access to the ccs_mode sysfs interface by tightening permissions on /sys/class/drm/card*/device/ attributes
Avoid running workloads that programmatically reconfigure CCS (Compute Command Streamer) mode on affected kernels
Where feasible, switch to a kernel version outside the affected range until the patch is applied

bash

# Verify running kernel version
uname -r

# Check for the xe driver and ccs_mode attribute
lsmod | grep xe
find /sys -name 'ccs_mode' 2>/dev/null

# Inspect kernel log for the relevant warning signature
dmesg | grep -i 'Missing outer runtime PM protection'