CVE-2026-46309: drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise
In the Linux kernel, the following vulnerability has been resolved:
drm/xe/uapi: Reject cohnone PAT index for CPU cached memory in madvise
Add validation in xevmmadviseioctl() to reject PAT indices with XECOHNONE coherency mode when applied to CPU cached memory.
Using cohnone with CPU cached buffers is a security issue. When the kernel clears pages before reallocation, the clear operation stays in CPU cache (dirty). GPU with cohnone can bypass CPU caches and read stale sensitive data directly from DRAM, potentially leaking data from previously freed pages of other processes.
This aligns with the existing validation in vmbind path (xevmbindioctlvalidatebo).
v2(Matthew brost) - Add fixes - Move one debug print to better place
v3(Matthew Auld) - Should be drm/xe/uapi - More Cc
v4(Shuicheng Lin) - Fix kmem leak issues by the way
v5 - Remove kmem leak because it has been merged by another patch
v6 - Remove the fix which is not related to current fix
v7 - No change
v8 - Rebase
v9 - Limit the restrictions to iGPU
v10 - No change
(cherry picked from commit 016ccdb674b8c899940b3944952c96a6a490d10a)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In xe_vm_madvise_ioctl(), add validation to reject PAT indices with CPU cache (dirty) for XE_COH_NONE. This prevents using XE_COH_NONE coherency mode with CPU cached (dirty) buffers, aligning with existing validation in the vm_bind path and addressing the security issue.
Linux kernel drm/xe/uapi madvise ioctl PAT index validation for XE_COH_NONE with CPU cached (dirty) memory = Reject PAT indices with CPU cache (dirty) when using XE_COH_NONE coherency mode
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46309?
CVE-2026-46309 has a risk score of 47, indicating a moderate severity level.
How do I fix CVE-2026-46309?
To fix CVE-2026-46309, ensure that your Linux kernel is updated to the latest version where this vulnerability has been patched.
What impact does CVE-2026-46309 have on Linux systems?
CVE-2026-46309 could potentially allow improper coherency handling for CPU cached memory, leading to stability issues.
Which versions of the Linux kernel are affected by CVE-2026-46309?
CVE-2026-46309 affects versions of the Linux kernel with the drm/xe/uapi component prior to the fix applied on June 8, 2026.
What does CVE-2026-46309 address specifically?
CVE-2026-46309 addresses a validation issue in the madvise function that allows rejecting invalid PAT indices with XE_COH_NONE coherency mode for CPU cached memory.