CVE-2025-21939

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/hmm: Don't dereference struct page pointers without notifier lock

The pnfs that we obtain from hmm_range_fault() point to pages that

we don't have a reference on, and the guarantee that they are still

in the cpu page-tables is that the notifier lock must be held and the

notifier seqno is still valid.

So while building the sg table and marking the pages accesses / dirty

we need to hold this lock with a validated seqno.

However, the lock is reclaim tainted which makes

sg_alloc_table_from_pages_segment() unusable, since it internally

allocates memory.

Instead build the sg-table manually. For the non-iommu case

this might lead to fewer coalesces, but if that's a problem it can

be fixed up later in the resource cursor code. For the iommu case,

the whole sg-table may still be coalesced to a single contigous

device va region.

This avoids marking pages that we don't own dirty and accessed, and

it also avoid derefe

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References