CVE-2026-80606: drm/xe/userptr: Hold notifier_lock for write on inject test path

Published Aug 28, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/userptr: Hold notifierlock for write on inject test path

When CONFIGDRMXEUSERPTRINVALINJECT=y, xeptsvmuserptrprecommit() runs vmacheckuserptr() with the svm notifierlock taken for read. The test injection causes vmacheckuserptr() to call xevmauserptrforceinvalidate(), which feeds into xevmauserptrdoinval() with drmgpusvmctx.innotifier=true. That flag tells drmgpusvmunmappages() the caller already holds notifierlock for write and only asserts the mode. Because the caller actually holds it for read, the assertion fires:

WARNING: drivers/gpu/drm/drmgpusvm.c:1669 at \ drmgpusvmunmappages+0xd4/0x130 [drmgpusvmhelper] Call Trace: xevmauserptrdoinval+0x40d/0xfd0 [xe] xevmauserptrinvalidatepass1+0x3e6/0x8d0 [xe] xevmauserptrforceinvalidate+0xde/0x290 [xe] vmacheckuserptr.constprop.0+0x1c6/0x220 [xe] xeptsvmuserptrprecommit+0x6a3/0xc60 [xe] ... xevmbindioctl+0x3a0a/0x4480 [xe]

Acquire notifierlock for write in pre-commit when the inject Kconfig is enabled, via new helpers xeptsvmuserptrnotifierlock()/unlock(). Rename xesvmassertheldread() to xesvmassertheldreadorinjectwrite() so it asserts the correct mode under each build configuration. Production builds (CONFIGDRMXEUSERPTRINVALINJECT=n) keep the existing read-mode behavior bit-for-bit.

(cherry picked from commit 80ccbd97ffee8ad2e73167d826fe7be548364365)

Affected Software

1 affected component
Linux Linux kernel

Event History

Aug 28, 2026
CVE Published
via MITRE·06:48 AM
Data Sourced
via MITRE·06:48 AM
Description

Frequently Asked Questions

1

Which systems are affected by this issue?

The issue applies to Linux kernel systems using the drm/xe userptr path with CONFIG_DRM_XE_USERPTR_INVAL_INJECT enabled. The problematic path is an injection test path rather than the normal configuration described here.

2

What triggers the warning?

During xe_pt_svm_userptr_pre_commit(), the test injection can force userptr invalidation while notifier_lock is held for read. The subsequent unmap path treats drm_gpusvm_ctx.in_notifier=true as meaning that the lock is held for write, causing a lock-mode assertion warning.

3

What is the available remediation?

Apply a kernel update containing the referenced stable commits. The fix takes notifier_lock for write during pre-commit when the injection configuration is enabled, using xe_pt_svm_userptr_notifier_lock() and xe_pt_svm_userptr_notifier_unlock().

4

How can I identify a system that has encountered the issue?

Affected execution produces a WARNING in drivers/gpu/drm/drm_gpusvm.c at drm_gpusvm_unmap_pages. The call trace includes xe_vma_userptr_do_inval, xe_vma_userptr_force_invalidate, xe_pt_svm_userptr_pre_commit, and xe_vm_bind_ioctl.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203