CVE-2026-80606: drm/xe/userptr: Hold notifier_lock for write on inject test path
In the Linux kernel, the following vulnerability has been resolved:
drm/xe/userptr: Hold notifierlock for write on inject test path
When CONFIGDRMXEUSERPTRINVALINJECT=y, xeptsvmuserptrprecommit() runs vmacheckuserptr() with the svm notifierlock taken for read. The test injection causes vmacheckuserptr() to call xevmauserptrforceinvalidate(), which feeds into xevmauserptrdoinval() with drmgpusvmctx.innotifier=true. That flag tells drmgpusvmunmappages() the caller already holds notifierlock for write and only asserts the mode. Because the caller actually holds it for read, the assertion fires:
WARNING: drivers/gpu/drm/drmgpusvm.c:1669 at \ drmgpusvmunmappages+0xd4/0x130 [drmgpusvmhelper] Call Trace: xevmauserptrdoinval+0x40d/0xfd0 [xe] xevmauserptrinvalidatepass1+0x3e6/0x8d0 [xe] xevmauserptrforceinvalidate+0xde/0x290 [xe] vmacheckuserptr.constprop.0+0x1c6/0x220 [xe] xeptsvmuserptrprecommit+0x6a3/0xc60 [xe] ... xevmbindioctl+0x3a0a/0x4480 [xe]
Acquire notifierlock for write in pre-commit when the inject Kconfig is enabled, via new helpers xeptsvmuserptrnotifierlock()/unlock(). Rename xesvmassertheldread() to xesvmassertheldreadorinjectwrite() so it asserts the correct mode under each build configuration. Production builds (CONFIGDRMXEUSERPTRINVALINJECT=n) keep the existing read-mode behavior bit-for-bit.
(cherry picked from commit 80ccbd97ffee8ad2e73167d826fe7be548364365)
Affected Software
Event History
Frequently Asked Questions
Which systems are affected by this issue?
The issue applies to Linux kernel systems using the drm/xe userptr path with CONFIG_DRM_XE_USERPTR_INVAL_INJECT enabled. The problematic path is an injection test path rather than the normal configuration described here.
What triggers the warning?
During xe_pt_svm_userptr_pre_commit(), the test injection can force userptr invalidation while notifier_lock is held for read. The subsequent unmap path treats drm_gpusvm_ctx.in_notifier=true as meaning that the lock is held for write, causing a lock-mode assertion warning.
What is the available remediation?
Apply a kernel update containing the referenced stable commits. The fix takes notifier_lock for write during pre-commit when the injection configuration is enabled, using xe_pt_svm_userptr_notifier_lock() and xe_pt_svm_userptr_notifier_unlock().
How can I identify a system that has encountered the issue?
Affected execution produces a WARNING in drivers/gpu/drm/drm_gpusvm.c at drm_gpusvm_unmap_pages. The call trace includes xe_vma_userptr_do_inval, xe_vma_userptr_force_invalidate, xe_pt_svm_userptr_pre_commit, and xe_vm_bind_ioctl.