CVE-2026-90064: drm/xe: Reject page faults from non-fault-mode scratch VMs
In the Linux kernel, the following vulnerability has been resolved:
drm/xe: Reject page faults from non-fault-mode scratch VMs
Having scratch enabled does not make a VM capable of handling recoverable page faults. Allowing scratch VMs through the ASID lookup also admits dma-fence mode VMs.
If such a VM faults on an already valid VMA, the handler reports success without fixing the fault, causing the GPU to retry indefinitely.
Only allow fault-mode VMs through the ASID lookup. Fault-mode VMs using scratch remain supported, while faults from 3D VMs are rejected.
(cherry picked from commit bfb24a06405b652d37831f3fb66b71d33a6605de)
Affected Software
Event History
Frequently Asked Questions
Which GPU virtual machines are affected by the faulty page-fault handling?
The issue affects non-fault-mode scratch VMs, including dma-fence mode VMs admitted through the ASID lookup. Fault-mode VMs that use scratch remain supported, while faults from 3D VMs are rejected by the fix.
What conditions lead to the GPU retrying indefinitely?
A non-fault-mode scratch VM must fault on an already valid VMA. The handler can then report success without resolving the fault, causing repeated GPU retries.
How does the fix mitigate the issue?
The fix restricts ASID lookup to fault-mode VMs. This prevents page faults from non-fault-mode scratch and 3D VMs from being handled as recoverable faults.