CVE-2026-93248: drm/xe: don't WARN on kernel job timeout when device already wedged
In the Linux kernel, the following vulnerability has been resolved:
drm/xe: don't WARN on kernel job timeout when device already wedged
igt@xewedged@wedged-at-any-timeout wedges the device in mode 2 (UPONANYHANGNORESET) and then rebinds the driver. During unbind, a GSC proxy kernel submission can still time out; with the device wedged and the GuC CT stopped it can never complete, so its kernel job times out.
Tile0: GT1: Kernel-submitted job timed out WARNING: drivers/gpu/drm/xe/xegucsubmit.c:... at gucexecqueuetimedoutjob() Workqueue: gt-ordered-wq drmschedjobtimedout
Killed queues skip gucsubmithintwedged(), leaving 'wedged' false even though the device is already wedged. The timeout handler then treats the kernel queue timeout as unexpected and taints the kernel.
Honour an already-wedged device even for killed queues so the expected teardown timeout no longer trips the WARN.
(cherry picked from commit a1c1dbd0f047bb05de6aaf6abe9103031179bf19)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch a1c1dbd0f047bb05de6aaf6abe9103031179bf19
Event History
Frequently Asked Questions
How can I tell whether this issue has occurred on a system?
Check kernel logs during xe driver unbind or rebind for a kernel-submitted job timeout followed by a WARNING in guc_exec_queue_timedout_job(), potentially on the gt-ordered-wq workqueue. The affected scenario involves a device already wedged with GuC CT stopped.
What operational sequence is associated with the warning?
The reported sequence wedges the device in mode 2, UPON_ANY_HANG_NO_RESET, and then rebinds the driver. A GSC proxy kernel submission may time out during unbind, and killed queues can leave the submission path unaware that the device was already wedged.
Where can I obtain the resolved change?
The resolved change is available in the referenced stable kernel commits 24d81b72992006f9c390f1fc85c7f991e6d06fd6 and 13087ad7817e6e5f210064518bfc4d6d58a9c2f3.