CVE-2026-74440

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

drm/xe: Wait on external BO kernel fences in exec IOCTL

Before arming a user job, xe_exec_ioctl() only added the VM's

dma-resv KERNEL slot as a dependency. That slot covers rebinds and

the kernel operations of the VM's private BOs, but not external BOs

(bo->vm == NULL), which carry their kernel operations (evictions,

moves, ...) in their own dma-resv KERNEL slot.

The DMA_RESV_USAGE_KERNEL slot is the cross-driver contract for

memory management operations that must complete before the BO or its

backing store may be used: any accessor is required to wait on the

KERNEL fences before touching the resv. By skipping the external BOs'

KERNEL slots, the exec path violated that contract and could schedule

a user job while a kernel operation on an external BO mapped by the VM

was still in flight, racing against it and potentially reading or

writing memory that was being moved.

Replace the VM-only dependency with an iteration

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References