CVE-2026-98521 Overview
CVE-2026-98521 is a Linux kernel vulnerability in the Intel i915 Direct Rendering Manager (DRM) graphics driver. The flaw involves an incorrect Read-Copy-Update (RCU) teardown order in i915_gem_busy_ioctl. When a Graphics Execution Manager (GEM) object is destroyed concurrently with the ioctl, the fence iteration can enter an endless loop. This results in a local Denial of Service condition on affected systems.
Critical Impact
A local unprivileged process invoking i915_gem_busy_ioctl can trigger an infinite loop in kernel context, consuming CPU resources and causing a denial of service on systems using Intel integrated graphics.
Affected Products
- Linux kernel versions containing the vulnerable drm/i915 subsystem code
- Systems running Intel integrated graphics using the i915 DRM driver
- Distributions shipping affected stable kernel branches prior to the referenced patch commits
Discovery Timeline
- 2026-10-18 - CVE-2026-98521 published to NVD
- 2026-10-19 - Last updated in NVD database
Technical Details for CVE-2026-98521
Vulnerability Analysis
The vulnerability resides in the i915_gem_busy_ioctl function within the Intel i915 DRM driver. The function uses dma_resv_for_each_fence_unlocked() to iterate over fences attached to a GEM object. The iteration proceeds without holding a reference on the object, relying only on the RCU read-side lock for protection.
If the GEM object is destroyed concurrently while the ioctl is executing, the destruction path drops all dma_fence references without freeing the GEM object memory. The dma_resv_for_each_fence_unlocked() iterator detects a destroyed fence and assumes a new fence list has been installed, triggering a loop restart. Because no new fence list is installed during object destruction, only freed, the loop never terminates.
Root Cause
The root cause is an ordering issue between fence reference teardown and the RCU grace period. The destruction path releases dma_fence references before the RCU grace period elapses. Concurrent readers iterating fences under RCU protection observe destroyed fences and spin indefinitely trying to restart iteration. This is a race condition compounded by a kernel-level infinite loop condition.
Attack Vector
An attacker with local access and the ability to open a DRM device node can trigger the condition by racing object destruction against calls to DRM_IOCTL_I915_GEM_BUSY. Sustained triggering of the race results in kernel threads stuck in the fence iteration loop, exhausting CPU resources. The patch resolves the issue by deferring fence reference drops until after the RCU grace period completes, ensuring iterators observe a consistent state.
// No verified exploit code is published for CVE-2026-98521.
// Refer to the upstream kernel commits for the full patch diff:
// https://git.kernel.org/stable/c/5113479556025093bf8133bb2dcaa33be2d50921
Detection Methods for CVE-2026-98521
Indicators of Compromise
- Kernel threads or user processes stuck at 100% CPU inside i915_gem_busy_ioctl or dma_resv_for_each_fence_unlocked stack frames.
- soft lockup or rcu_sched self-detected stall messages in dmesg referencing the i915 driver.
- Unresponsive graphical sessions or compositor hangs on systems with Intel integrated graphics.
Detection Strategies
- Monitor kernel ring buffer output for RCU stall warnings and soft lockup traces originating in the DRM subsystem.
- Correlate per-process CPU time with perf or ftrace samples showing extended time in i915 ioctl handlers.
- Audit running kernel versions against the fixed commits listed in the upstream references to identify unpatched hosts.
Monitoring Recommendations
- Collect dmesg and /var/log/kern.log output to a centralized log store for stall and lockup pattern matching.
- Alert on sustained kernel-mode CPU utilization combined with DRM-related syscall activity from unprivileged processes.
- Track Linux kernel package versions across the fleet to confirm patch coverage on systems with Intel GPUs.
How to Mitigate CVE-2026-98521
Immediate Actions Required
- Identify all Linux hosts using the i915 DRM driver by checking lsmod | grep i915 and inventorying kernel versions.
- Apply distribution-provided kernel updates that incorporate the upstream fix commits as soon as they become available.
- Reboot affected systems after patching to load the fixed kernel image.
Patch Information
The fix was committed upstream and backported across stable kernel branches. Relevant references include Kernel Git Commit 2dd0190e, Kernel Git Commit 4d4ca842, Kernel Git Commit b12e041a, Kernel Git Commit c53db9cc, Kernel Git Commit cc890d3f, and Kernel Git Commit d2da6696. The fix defers dropping dma_fence references until after the RCU grace period expires.
Workarounds
- Restrict access to DRM device nodes (/dev/dri/card*) to trusted users through group membership and udev rules on multi-user systems.
- Where graphical workloads are not required, blacklist the i915 module on server systems to remove the attack surface.
- Monitor for and terminate processes exhibiting runaway CPU usage inside i915 ioctl handlers until a patched kernel is deployed.
# Verify current kernel and i915 module status
uname -r
lsmod | grep i915
# Example: restrict /dev/dri access to the 'video' group
cat <<'EOF' | sudo tee /etc/udev/rules.d/99-dri-restrict.rules
SUBSYSTEM=="drm", KERNEL=="card*", GROUP="video", MODE="0660"
EOF
sudo udevadm control --reload-rules && sudo udevadm trigger
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
