CVE-2026-80915 Overview
CVE-2026-80915 affects the Linux kernel's drm/xe graphics driver, specifically the Display Page Table (DPT) allocation paths. The flaw involves incorrect fallback behavior when allocating memory for display page tables. The VRAM-to-system-memory fallback path does not function, producing black screens accompanied by pipe fault errors. On systems with a media GT (graphics tile), accessing stolen memory while the GT is in the MC6 power state introduces additional latency. The driver also lacks accounting for stolen memory usage, meaning DPT allocations can exhaust the entire stolen region. Under load, using stolen memory can cause random system hangs.
Critical Impact
Faulty DPT allocation paths in the drm/xe driver can trigger display pipe faults, black screens, and random system hangs on affected Linux systems with Intel Xe graphics.
Affected Products
- Linux kernel with the drm/xe graphics driver enabled
- Systems using Intel Xe-based GPUs with Display Page Table allocation
- Platforms with a media GT that transitions into the MC6 power state
Discovery Timeline
- 2026-09-09 - CVE-2026-80915 published to the National Vulnerability Database (NVD)
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-80915
Vulnerability Analysis
The vulnerability resides in the Display Page Table (DPT) allocation logic of the Linux kernel drm/xe driver. DPTs are used to map display surfaces for scanout on Intel Xe graphics hardware. The driver previously attempted two fallback strategies when the preferred memory region was unavailable: falling back from VRAM to system memory, and using stolen memory as an allocation target. Testing showed the VRAM-to-system-memory fallback did not function; the display pipeline produced only black screens with pipe fault errors. The stolen memory path introduced separate reliability problems. On platforms with a media GT, latency increased when the GT was parked in the MC6 low-power state. Because the driver did not track how much stolen memory had been consumed, DPT allocations could exhaust the region and trigger random hangs under sustained load.
Root Cause
The root cause combines a non-functional memory fallback path with unbounded allocation from a constrained memory region. Neither condition is validated before allocation proceeds, producing display faults or system instability depending on the code path taken. The fix, applied in upstream commit a196406a3831291598fe8e73245914f7acffdfe0, removes both problematic paths and restricts DPT allocations to the default memory region.
Attack Vector
This defect is a reliability and stability issue in kernel graphics code rather than a remotely exploitable memory-corruption flaw. No proof-of-concept exploit or CVSS vector has been published in the NVD entry. Impact requires the affected drm/xe driver to be active and exercised through display or graphics workloads. See the upstream commits for the fix details: Kernel Git Commit 491c499, Kernel Git Commit c457e2c, Kernel Git Commit f034150, and Kernel Git Commit fc64875.
Detection Methods for CVE-2026-80915
Indicators of Compromise
- Kernel log entries reporting display pipe fault errors originating from the drm/xe driver.
- Black screen conditions on modeset or resume on systems using Intel Xe graphics.
- Unexplained system hangs correlated with graphics workloads on hardware with a media GT.
Detection Strategies
- Query the running kernel version against the fixed commit set and flag hosts still running vulnerable drm/xe code.
- Parse dmesg and journald output for xe, DPT, and pipe fault strings to identify affected systems.
- Correlate GPU-driver warnings with system stability events collected from endpoint telemetry.
Monitoring Recommendations
- Aggregate kernel ring buffer logs into a centralized log store and alert on repeated drm/xe fault messages.
- Track workstation and edge-device uptime for unexplained reboots on Intel Xe hardware.
- Monitor stolen memory accounting or graphics memory pressure where telemetry is available.
How to Mitigate CVE-2026-80915
Immediate Actions Required
- Inventory Linux systems using the drm/xe driver and prioritize those with Intel Xe GPUs and a media GT.
- Apply the stable kernel update that includes commit a196406a3831291598fe8e73245914f7acffdfe0 or its backport.
- Reboot affected systems after patching to load the corrected driver.
Patch Information
The fix removes the broken VRAM-to-system-memory fallback and prevents DPT allocations from consuming stolen memory. It is available in the following stable branches: Kernel Git Commit 491c499, Kernel Git Commit c457e2c, Kernel Git Commit f034150, and Kernel Git Commit fc64875.
Workarounds
- Where patching is delayed, avoid running graphics-intensive workloads on affected hardware.
- Consider disabling the drm/xe driver on systems where alternative graphics stacks are viable.
- Reduce media GT MC6 transitions by adjusting GPU power-management tunables until a fixed kernel is deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
