In the Linux kernel, the following vulnerability has been resolved:
drm/xe: Process deferred GGTT node removals on device unwind
While we are indirectly draining our dedicated workqueue ggtt->wq that we use to complete asynchronous removal of some GGTT nodes, this happends as part of the managed-drm unwinding (ggtt_fini_early), which could be later then manage-device unwinding, where we could already unmap our MMIO/GMS mapping (mmio_fini).
This was recently observed during unsuccessful VF initialization:
[ ] xe 0000:00:02.1: probe with driver xe failed with error -62 [ ] xe 0000:00:02.1: DEVRES REL ffff88811e747340 __xe_bo_unpin_map_no_vm (16 bytes) [ ] xe 0000:00:02.1: DEVRES REL ffff88811e747540 __xe_bo_unpin_map_no_vm (16 bytes) [ ] xe 0000:00:02.1: DEVRES REL ffff88811e747240 __xe_bo_unpin_map_no_vm (16 bytes) [ ] xe 0000:00:02.1: DEVRES REL ffff88811e747040 tiles_fini (16 bytes) [ ] xe 0000:00:02.1: DEVRES REL ffff88811e746840 mmio_fini (16 bytes) [ ] xe 0000:00:02.1: DEVRES REL ffff88811e747f40 xe_bo_pinned_fini (16 bytes) [ ] xe 0000:00:02.1: DEVRES REL ffff88811e746b40 devm_drm_dev_init_release (16 bytes) [ ] xe 0000:00:02.1: [drm:drm_managed_release] drmres release begin [ ] xe 0000:00:02.1: [drm:drm_managed_release] REL ffff88810ef81640 __fini_relay (8 bytes) [ ] xe 0000:00:02.1: [drm:drm_managed_release] REL ffff88810ef80d40 guc_ct_fini (8 bytes) [ ] xe 0000:00:02.1: [drm:drm_managed_release] REL ffff88810ef80040 __drmm_mutex_release (8 bytes) [ ] xe 0000:00:02.1: [drm:drm_managed_release] REL ffff88810ef80140 ggtt_fini_early (8 bytes)
and this was leading to:
[ ] BUG: unable to handle page fault for address: ffffc900058162a0 [ ] #PF: supervisor write access in kernel mode [ ] #PF: error_code(0x0002) - not-present page [ ] Oops: Oops: 0002 [#1] SMP NOPTI [ ] Tainted: [W]=WARN [ ] Workqueue: xe-ggtt-wq ggtt_node_remove_work_func [xe] [ ] RIP: 0010:xe_ggtt_set_pte+0x6d/0x350 [xe] [ ] Call Trace: [ ] <TASK> [ ] xe_ggtt_clear+0xb0/0x270 [xe] [ ] ggtt_node_remove+0xbb/0x120 [xe] [ ] ggtt_node_remove_work_func+0x30/0x50 [xe] [ ] process_one_work+0x22b/0x6f0 [ ] worker_thread+0x1e8/0x3d
Add managed-device action that will explicitly drain the workqueue with all pending node removals prior to releasing MMIO/GSM mapping.
(cherry picked from commit 89d2835c3680ab1938e22ad81b1c9f8c686bd391)
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Redhat_linux | — | No solution exists | Jul 31, 2025 | Jul 25, 2025 |
| Suse | — | Upgrade kernel-default-optionalUpgrade kernel-docs-htmlUpgrade kernel-kvmsmallUpgrade ocfs2-kmp-64kbUpgrade kernel-obs-qaUpgrade cluster-md-kmp-rtUpgrade dlm-kmp-64kbUpgrade gfs2-kmp-64kbUpgrade dtb-broadcomUpgrade dtb-freescaleUpgrade dtb-apmUpgrade kselftests-kmp-64kbUpgrade kernel-64kb-optionalUpgrade kernel-devel-azureUpgrade kernel-64kb-develUpgrade dtb-caviumUpgrade ocfs2-kmp-defaultUpgrade dtb-exynosUpgrade kernel-64kbUpgrade dtb-amlogicUpgrade kernel-default-develUpgrade kernel-symsUpgrade kernel-default-vdsoUpgrade kernel-rt-optionalUpgrade dtb-lgUpgrade ocfs2-kmp-rtUpgrade dtb-hisiliconUpgrade kernel-source-azureUpgrade dtb-amazonUpgrade kernel-sourceUpgrade kernel-rt-livepatchUpgrade kernel-azure-develUpgrade kernel-default-extraUpgrade kernel-zfcpdumpUpgrade dtb-amdUpgrade kernel-syms-azureUpgrade gfs2-kmp-rtUpgrade kernel-kvmsmall-vdsoUpgrade dtb-alteraUpgrade kernel-macrosUpgrade dtb-qcomUpgrade kernel-develUpgrade kernel-rtUpgrade dtb-appleUpgrade kernel-default-livepatchUpgrade dtb-marvellUpgrade kernel-kvmsmall-develUpgrade kselftests-kmp-rtUpgrade dlm-kmp-defaultUpgrade kernel-azureUpgrade cluster-md-kmp-defaultUpgrade kernel-rt-develUpgrade dtb-socionextUpgrade kernel-64kb-extraUpgrade dtb-xilinxUpgrade dtb-rockchipUpgrade kernel-source-vanillaUpgrade kernel-docsUpgrade kernel-default-livepatch-develUpgrade dtb-nvidiaUpgrade gfs2-kmp-defaultUpgrade kernel-default-baseUpgrade dtb-sprdUpgrade kernel-rt-extraUpgrade dtb-renesasUpgrade kselftests-kmp-defaultUpgrade dtb-mediatekUpgrade cluster-md-kmp-64kbUpgrade kernel-obs-buildUpgrade kernel-defaultUpgrade dtb-allwinnerUpgrade dlm-kmp-rtUpgrade reiserfs-kmp-defaultUpgrade kernel-rt-vdsoUpgrade kernel-rt-livepatch-develUpgrade dtb-arm | Dec 5, 2025 | Aug 18, 2025 |
| Ubuntu | — | Upgrade linux-image-virtualUpgrade linux-image-azure-nvidia-6.14Upgrade linux-image-oem-6.14Upgrade linux-image-virtual-6.14Upgrade linux-image-generic-64kUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.14.0-1015-oracle-64kUpgrade linux-image-oem-24.04aUpgrade linux-image-6.14.0-1018-gcpUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-oracle-64k-6.14Upgrade linux-image-gcpUpgrade linux-image-oem-24.04cUpgrade linux-image-genericUpgrade linux-image-oem-24.04bUpgrade linux-image-oracle-64kUpgrade linux-image-6.14.0-1015-aws-64kUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-6.14.0-1014-realtimeUpgrade linux-image-azure-nvidiaUpgrade linux-image-realtimeUpgrade linux-image-oem-24.04Upgrade linux-image-awsUpgrade linux-image-aws-64kUpgrade linux-image-6.14.0-34-genericUpgrade linux-image-6.14.0-1018-gcp-64kUpgrade linux-image-gcp-6.14Upgrade linux-image-6.14.0-1014-azureUpgrade linux-image-6.14.0-1015-oracleUpgrade linux-image-oracle-6.14Upgrade linux-image-aws-6.14Upgrade linux-image-6.14.0-1014-oemUpgrade linux-image-6.14.0-1015-awsUpgrade linux-image-azure-6.14Upgrade linux-image-generic-6.14Upgrade linux-image-raspi-6.14Upgrade linux-image-6.14.0-34-generic-64kUpgrade linux-image-realtime-6.14Upgrade linux-image-generic-64k-6.14Upgrade linux-image-azureUpgrade linux-image-gcp-64k-6.14Upgrade linux-image-6.14.0-1007-azure-nvidiaUpgrade linux-image-6.14.0-1016-raspiUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-gcp-64kUpgrade linux-image-aws-64k-6.14Upgrade linux-image-oracleUpgrade linux-image-raspi | Jul 31, 2025 | Jul 25, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub