CVE-2026-31656

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat

A use-after-free / refcount underflow is possible when the heartbeat

worker and intel_engine_park_heartbeat() race to release the same

engine->heartbeat.systole request.

The heartbeat worker reads engine->heartbeat.systole and calls

i915_request_put() on it when the request is complete, but clears

the pointer in a separate, non-atomic step. Concurrently, a request

retirement on another CPU can drop the engine wakeref to zero, triggering

__engine_park() -> intel_engine_park_heartbeat(). If the heartbeat

timer is pending at that point, cancel_delayed_work() returns true and

intel_engine_park_heartbeat() reads the stale non-NULL systole pointer

and calls i915_request_put() on it again, causing a refcount underflow:

```

<4> [487.221889] Workqueue: i915-unordered engine_retire [i915]

<4> [487.222640] RIP: 0010:refcount_warn_saturate+0x68/0xb0

...

<4> [48

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References