CVE-2026-80606 Overview
CVE-2026-80606 affects the Linux kernel's drm/xe GPU driver, specifically the userptr subsystem. The flaw exists in xe_pt_svm_userptr_pre_commit() when built with CONFIG_DRM_XE_USERPTR_INVAL_INJECT=y. The pre-commit path calls vma_check_userptr() while holding the shared virtual memory (SVM) notifier_lock for read, but the injection code path expects the lock to be held for write. This mismatch triggers a lock-mode assertion in drm_gpusvm_unmap_pages(), producing a kernel warning during xe_vm_bind_ioctl operations.
Critical Impact
Local users invoking GPU virtual memory bind ioctls on affected kernels can trigger a lock assertion in the drm/xe driver, resulting in kernel warnings and potential concurrency issues under the SVM notifier lock.
Affected Products
- Linux kernel builds of the drm/xe driver with CONFIG_DRM_XE_USERPTR_INVAL_INJECT=y
- Linux kernel stable trees prior to the commits referenced in the patch series
- Systems using Intel Xe GPUs with shared virtual memory (SVM) userptr functionality
Discovery Timeline
- 2026-08-28 - CVE-2026-80606 published to the National Vulnerability Database
- 2026-08-29 - Last updated in the NVD database
Technical Details for CVE-2026-80606
Vulnerability Analysis
The drm/xe driver implements shared virtual memory (SVM) semantics for GPU userptr mappings. It relies on a notifier_lock to serialize memory management notifier callbacks against page unmap operations. The lock supports read and write modes, and downstream helpers assert the correct mode before proceeding.
When the debug injection option CONFIG_DRM_XE_USERPTR_INVAL_INJECT is enabled, xe_pt_svm_userptr_pre_commit() acquires the notifier_lock for read and calls vma_check_userptr(). The injection logic then forces an invalidation through xe_vma_userptr_force_invalidate(), which routes into xe_vma_userptr_do_inval() with drm_gpusvm_ctx.in_notifier=true. That flag signals to drm_gpusvm_unmap_pages() that the caller already holds the lock for write. The assertion at drivers/gpu/drm/drm_gpusvm.c:1669 then fires because the actual lock mode is read.
Root Cause
The root cause is a race condition and lock-mode mismatch [CWE-667] between the pre-commit path and the notifier unmap logic. The in_notifier=true contract requires exclusive (write) access to notifier_lock, but the injection call site holds it in shared (read) mode. Production kernels without the inject Kconfig are unaffected because the injection path is compiled out.
Attack Vector
Exploitation requires local access to a system running an affected kernel with the debug injection option enabled. An attacker with permission to issue xe_vm_bind_ioctl calls against the Xe GPU driver can trigger the code path. The result is a WARNING splat in the kernel log and unsafe access to SVM state under the wrong lock mode. Because the affected configuration is typically used in development or test builds, real-world exposure on production systems is limited.
No public proof-of-concept exists. The vulnerability is described in prose because verified exploit code has not been released. See the upstream fix commits referenced below for the code-level change.
Detection Methods for CVE-2026-80606
Indicators of Compromise
- Kernel log entries containing WARNING: drivers/gpu/drm/drm_gpusvm.c:1669 at drm_gpusvm_unmap_pages
- Call traces referencing xe_vma_userptr_do_inval, xe_vma_userptr_force_invalidate, or xe_pt_svm_userptr_pre_commit
- Repeated xe_vm_bind_ioctl invocations from unprivileged user-space processes preceding the warning
Detection Strategies
- Audit kernel build configurations for CONFIG_DRM_XE_USERPTR_INVAL_INJECT=y on production systems.
- Monitor dmesg and journalctl -k output for the specific assertion path in drm_gpusvm_unmap_pages.
- Correlate process-level ioctl telemetry with kernel warning events to identify local processes exercising the Xe userptr path.
Monitoring Recommendations
- Ingest kernel logs into a centralized data lake and alert on WARNING traces originating in drm_gpusvm or xe modules.
- Track kernel package versions across the fleet and flag hosts running unpatched drm/xe builds.
- Baseline expected users of GPU compute workloads; investigate unexpected local processes issuing xe_vm_bind_ioctl.
How to Mitigate CVE-2026-80606
Immediate Actions Required
- Apply the upstream Linux kernel patches that acquire notifier_lock for write on the inject test path.
- Disable CONFIG_DRM_XE_USERPTR_INVAL_INJECT in production kernel builds if the debug injection option is not required.
- Restrict local access on systems running affected kernels until patches are deployed.
Patch Information
The fix introduces xe_pt_svm_userptr_notifier_lock() and xe_pt_svm_userptr_notifier_unlock() helpers that take notifier_lock for write when the inject Kconfig is enabled. The helper xe_svm_assert_held_read() is renamed to xe_svm_assert_held_read_or_inject_write() so it asserts the correct mode per build. Production kernels retain read-mode behavior. Refer to the Kernel Commit ab9ea5c9, Kernel Commit dca6e08c, and Kernel Commit f9a9abd7 for the exact changes.
Workarounds
- Rebuild the kernel with CONFIG_DRM_XE_USERPTR_INVAL_INJECT=n to remove the vulnerable injection path entirely.
- Unload or blacklist the xe kernel module on systems that do not require Intel Xe GPU support.
- Limit access to /dev/dri device nodes to trusted users using group permissions and udev rules.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
