CVE-2026-23466: drm/xe: Open-code GGTT MMIO access protection
In the Linux kernel, the following vulnerability has been resolved:
drm/xe: Open-code GGTT MMIO access protection
GGTT MMIO access is currently protected by hotplug (drmdeventer), which works correctly when the driver loads successfully and is later unbound or unloaded. However, if driver load fails, this protection is insufficient because drmdevunplug() is never called.
Additionally, devm release functions cannot guarantee that all BOs with GGTT mappings are destroyed before the GGTT MMIO region is removed, as some BOs may be freed asynchronously by worker threads.
To address this, introduce an open-coded flag, protected by the GGTT lock, that guards GGTT MMIO access. The flag is cleared during the devfiniggtt devm release function to ensure MMIO access is disabled once teardown begins.
(cherry picked from commit 4f3a998a173b4325c2efd90bdadc6ccd3ad9a431)
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23466?
The severity of CVE-2026-23466 is high, rated at 7.8 on the CVSS scale.
How do I fix CVE-2026-23466?
To fix CVE-2026-23466, apply the available patch provided in the Linux kernel updates.
What type of vulnerability is CVE-2026-23466?
CVE-2026-23466 is a vulnerability related to the improper protection of GGTT MMIO access in the Linux kernel.
Which software is affected by CVE-2026-23466?
CVE-2026-23466 affects the Linux kernel, specifically the drm/xe subsystem.
When was CVE-2026-23466 published?
CVE-2026-23466 was published on April 3, 2026.