CVE-2026-80606: drm/xe/userptr: Hold notifier_lock for write on inject test path

Q: Which systems are affected by this issue?

The issue applies to Linux kernel systems using the drm/xe userptr path with CONFIG_DRM_XE_USERPTR_INVAL_INJECT enabled. The problematic path is an injection test path rather than the normal configuration described here.

Q: What triggers the warning?

During xe_pt_svm_userptr_pre_commit(), the test injection can force userptr invalidation while notifier_lock is held for read. The subsequent unmap path treats drm_gpusvm_ctx.in_notifier=true as meaning that the lock is held for write, causing a lock-mode assertion warning.

Q: What is the available remediation?

Apply a kernel update containing the referenced stable commits. The fix takes notifier_lock for write during pre-commit when the injection configuration is enabled, using xe_pt_svm_userptr_notifier_lock() and xe_pt_svm_userptr_notifier_unlock().

Q: How can I identify a system that has encountered the issue?

Affected execution produces a WARNING in drivers/gpu/drm/drm_gpusvm.c at drm_gpusvm_unmap_pages. The call trace includes xe_vma_userptr_do_inval, xe_vma_userptr_force_invalidate, xe_pt_svm_userptr_pre_commit, and xe_vm_bind_ioctl.

Published Aug 28, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/userptr: Hold notifierlock for write on inject test path

When CONFIGDRMXEUSERPTRINVALINJECT=y, xeptsvmuserptrprecommit() runs vmacheckuserptr() with the svm notifierlock taken for read. The test injection causes vmacheckuserptr() to call xevmauserptrforceinvalidate(), which feeds into xevmauserptrdoinval() with drmgpusvmctx.innotifier=true. That flag tells drmgpusvmunmappages() the caller already holds notifierlock for write and only asserts the mode. Because the caller actually holds it for read, the assertion fires:

WARNING: drivers/gpu/drm/drmgpusvm.c:1669 at \ drmgpusvmunmappages+0xd4/0x130 [drmgpusvmhelper] Call Trace: xevmauserptrdoinval+0x40d/0xfd0 [xe] xevmauserptrinvalidatepass1+0x3e6/0x8d0 [xe] xevmauserptrforceinvalidate+0xde/0x290 [xe] vmacheckuserptr.constprop.0+0x1c6/0x220 [xe] xeptsvmuserptrprecommit+0x6a3/0xc60 [xe] ... xevmbindioctl+0x3a0a/0x4480 [xe]

Acquire notifierlock for write in pre-commit when the inject Kconfig is enabled, via new helpers xeptsvmuserptrnotifierlock()/unlock(). Rename xesvmassertheldread() to xesvmassertheldreadorinjectwrite() so it asserts the correct mode under each build configuration. Production builds (CONFIGDRMXEUSERPTRINVALINJECT=n) keep the existing read-mode behavior bit-for-bit.

(cherry picked from commit 80ccbd97ffee8ad2e73167d826fe7be548364365)

Affected Software

127 affected componentsFixes available

Linux Linux kernel

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-intel-5.13*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle-6.5*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-aws-6.14*

ubuntu/linux-aws-6.17*

ubuntu/linux-aws-7.0<7.0.0-1014.14~24.04.1

7.0.0-1014.14~24.04.1

ubuntu/linux-azure-6.11*

ubuntu/linux-azure-6.14*

ubuntu/linux-azure-6.17*

ubuntu/linux-azure-7.0<7.0.0-1017.17~24.04.1

7.0.0-1017.17~24.04.1

ubuntu/linux-azure-fde-6.14*

ubuntu/linux-azure-fde-6.17*

ubuntu/linux-azure-fde-7.0<7.0.0-1016.16~24.04.1

7.0.0-1016.16~24.04.1

ubuntu/linux-azure-nvidia-6.14*

ubuntu/linux-gcp-6.11*

ubuntu/linux-gcp-6.14*

ubuntu/linux-gcp-7.0<7.0.0-1014.14~24.04.1

7.0.0-1014.14~24.04.1

ubuntu/linux-hwe-6.11*

ubuntu/linux-hwe-6.14*

ubuntu/linux-hwe-7.0<7.0.0-38.38~24.04.4

7.0.0-38.38~24.04.4

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-nvidia-6.11*

ubuntu/linux-nvidia-7.0<7.0.0-1024.25~24.04.1

7.0.0-1024.25~24.04.1

ubuntu/linux-oem-6.11*

ubuntu/linux-oem-6.14*

ubuntu/linux-oem-6.8*

ubuntu/linux-oracle-6.14*

ubuntu/linux-oracle-6.17*

ubuntu/linux-oracle-7.0<7.0.0-1013.13~24.04.1

7.0.0-1013.13~24.04.1

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-6.14*

ubuntu/linux-riscv-6.17*

ubuntu/linux-riscv-7.0<7.0.0-38.38.1~24.04.1

7.0.0-38.38.1~24.04.1

ubuntu/linux-realtime-6.14*

ubuntu/linux-realtime-6.17*

ubuntu/linux<7.0.0-38.38

7.0.0-38.38

ubuntu/linux-aws<7.0.0-1014.14

7.0.0-1014.14

ubuntu/linux-azure<7.0.0-1017.17

7.0.0-1017.17

ubuntu/linux-azure-fde<7.0.0-1016.16

7.0.0-1016.16

ubuntu/linux-gcp<7.0.0-1014.14

7.0.0-1014.14

ubuntu/linux-gke<7.0.0-1008.9

7.0.0-1008.9

ubuntu/linux-ibm<7.0.0-1015.15

7.0.0-1015.15

ubuntu/linux-nvidia*

ubuntu/linux-nvidia-bos<7.0.0-2022.23

7.0.0-2022.23

ubuntu/linux-oem-7.0<7.0.0-1015.15

7.0.0-1015.15

ubuntu/linux-oracle<7.0.0-1013.13

7.0.0-1013.13

ubuntu/linux-raspi*

ubuntu/linux-realtime<7.0.0-38.38.1

7.0.0-38.38.1

ubuntu/linux-riscv<7.0.0-38.38.1

7.0.0-38.38.1

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-aws-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1014.14~24.04.1
Upgrade
Upgrade ubuntu/linux-azure-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1017.17~24.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1016.16~24.04.1
Upgrade
Upgrade ubuntu/linux-gcp-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1014.14~24.04.1
Upgrade
Upgrade ubuntu/linux-hwe-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-38.38~24.04.4
Upgrade
Upgrade ubuntu/linux-nvidia-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1024.25~24.04.1
Upgrade
Upgrade ubuntu/linux-oracle-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1013.13~24.04.1
Upgrade
Upgrade ubuntu/linux-riscv-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-38.38.1~24.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 7.0.0-38.38
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 7.0.0-1014.14
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 7.0.0-1017.17
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 7.0.0-1016.16
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 7.0.0-1014.14
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 7.0.0-1008.9
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 7.0.0-1015.15
Upgrade
Upgrade ubuntu/linux-nvidia-bos to a version that resolves this vulnerability.
Fixed in 7.0.0-2022.23
Upgrade
Upgrade ubuntu/linux-oem-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1015.15
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 7.0.0-1013.13
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 7.0.0-38.38.1
Upgrade
Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.
Fixed in 7.0.0-38.38.1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 80ccbd97ffee8ad2e73167d826fe7be548364365

Event History

Aug 28, 2026

CVE Published

via MITRE·06:48 AM

Data Sourced

via MITRE·06:48 AM

DescriptionSeverity

Data Sourced

via OSV·08:16 AM

DescriptionSeverityAffected Software

Data Sourced

via NVD·08:16 AM

DescriptionSeverity

Frequently Asked Questions

Which systems are affected by this issue?

The issue applies to Linux kernel systems using the drm/xe userptr path with CONFIG_DRM_XE_USERPTR_INVAL_INJECT enabled. The problematic path is an injection test path rather than the normal configuration described here.

What triggers the warning?

During xe_pt_svm_userptr_pre_commit(), the test injection can force userptr invalidation while notifier_lock is held for read. The subsequent unmap path treats drm_gpusvm_ctx.in_notifier=true as meaning that the lock is held for write, causing a lock-mode assertion warning.

What is the available remediation?

Apply a kernel update containing the referenced stable commits. The fix takes notifier_lock for write during pre-commit when the injection configuration is enabled, using xe_pt_svm_userptr_notifier_lock() and xe_pt_svm_userptr_notifier_unlock().

How can I identify a system that has encountered the issue?

Affected execution produces a WARNING in drivers/gpu/drm/drm_gpusvm.c at drm_gpusvm_unmap_pages. The call trace includes xe_vma_userptr_do_inval, xe_vma_userptr_force_invalidate, xe_pt_svm_userptr_pre_commit, and xe_vm_bind_ioctl.

CVE-2026-80606: drm/xe/userptr: Hold notifier_lock for write on inject test path

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems are affected by this issue?

What triggers the warning?

What is the available remediation?

How can I identify a system that has encountered the issue?

Company

Resources

Contact