CVE-2026-63884: Linux Kernel Use-After-Free Vulnerability

CVE-2026-63884 Overview

CVE-2026-63884 is a use-after-free (UAF) vulnerability in the Linux kernel's Intel i915 DRM graphics driver. The flaw resides in the i915_ttm_purge code path, where the bo->ttm object pointer may be replaced by a call to ttm_bo_validate(). The original code cast the pointer to an i915_tt object before validation, resulting in dereferencing a freed or replaced structure. A reporter reproduced the crash on Intel Arc DG2 hardware under heavy graphics load, producing a general protection fault at i915_ttm_purge+0x84/0x100.

Critical Impact
Local users running graphics workloads on affected Intel GPUs can trigger memory corruption in kernel context, enabling denial of service and potential local privilege escalation.

Affected Products

Linux kernel builds containing the vulnerable drm/i915 TTM purge implementation
Systems using Intel discrete GPUs such as DG2 (Arc series) with the i915 driver
Kernel version 6.18.8 confirmed in the reporter's crash trace

Discovery Timeline

2026-07-19 - CVE-2026-63884 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63884

Vulnerability Analysis

The defect occurs in the Intel i915 DRM driver's Translation Table Manager (TTM) integration. The i915_ttm_purge function retrieves the TTM page vector container associated with a buffer object marked as no longer needed. During eviction, the function calls ttm_bo_validate() to change the object's placement and caching policy. That call can replace bo->ttm with a new instance when the buffer is still busy, freeing the previous structure.

The original code cached a pointer casted to i915_tt before invoking ttm_bo_validate(). After validation returns, subsequent dereferences target the stale pointer. The reporter's stack trace shows a general protection fault at address 0xa56b6b6b6b6b6b8b, indicating access to freed slab memory tagged with the SLUB poison pattern 0x6b.

Root Cause

The root cause is an ordering error in the pointer lifecycle. The fix moves the cast of bo->ttm to the i915_tt type until after ttm_bo_validate() completes, ensuring the pointer reflects the current TTM structure. This is a classic use-after-free pattern where an intermediate operation invalidates a cached reference.

Attack Vector

Exploitation requires local access with permission to issue graphics ioctls, such as i915_gem_execbuffer2_ioctl. An attacker with low privileges can submit crafted graphics workloads that repeatedly evict and purge TTM-backed buffer objects. Triggering the race during heavy memory pressure causes the freed i915_tt structure to be dereferenced, corrupting kernel memory. Successful exploitation depends on winning the eviction race and reclaiming the freed slab object with attacker-controlled data.

The vulnerability is described in prose only; see the Linux Kernel Change Log 073bcbc for the authoritative patch details.

Detection Methods for CVE-2026-63884

Indicators of Compromise

Kernel oops messages referencing i915_ttm_purge or i915_ttm_move in dmesg or journalctl output
General protection faults with faulting addresses containing the SLUB poison pattern 0x6b6b6b6b
Unexpected crashes of the Xorg, gnome-shell, or Wayland compositor processes on systems using the i915 driver

Detection Strategies

Monitor kernel ring buffers for panic or oops entries matching the i915_ttm_purge+0x84 signature
Correlate GPU workload spikes with kernel fault events to identify possible exploitation attempts
Audit installed kernel versions against the fixed commits published on git.kernel.org for the stable tree

Monitoring Recommendations

Ship kernel logs from Linux endpoints to a centralized logging or SIEM pipeline for pattern matching
Alert on repeated i915 driver faults from the same user session, which may indicate exploitation attempts rather than sporadic hardware issues
Track process crash telemetry for graphics clients that abnormally trigger kernel-level faults

How to Mitigate CVE-2026-63884

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 073bcbc9, 28b22dba, 5c4063c8, a29654d4, c9ae7e7e, and df73f3bc to affected stable branches
Update to a distribution kernel package that incorporates the drm/i915: Fix potential UAF in TTM object purge fix
Reboot systems after kernel updates to load the patched driver into memory

Patch Information

The fix reorders the cast of bo->ttm to i915_tt so it occurs after ttm_bo_validate() returns. Patches are available in the stable kernel tree. See the Linux Kernel Change Log 28b22db, Linux Kernel Change Log 5c4063c, and Linux Kernel Change Log df73f3b for the backport variants.

Workarounds

Restrict local shell and desktop access to trusted users, since the vulnerability requires local privileges to issue graphics ioctls
Limit or blacklist the i915 driver on servers that do not require Intel graphics functionality by adding it to modprobe blacklist configuration
Avoid sustained heavy GPU memory pressure workloads on unpatched systems using Intel DG2 hardware

bash

# Verify running kernel version and check for the fix
uname -r

# Confirm the i915 module is loaded
lsmod | grep i915

# Optional: blacklist i915 on systems that do not need it
echo "blacklist i915" | sudo tee /etc/modprobe.d/blacklist-i915.conf
sudo update-initramfs -u