CVE-2026-80606

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/userptr: Hold notifier_lock for write on inject test path

When CONFIG_DRM_XE_USERPTR_INVAL_INJECT=y, xe_pt_svm_userptr_pre_commit()

runs vma_check_userptr() with the svm notifier_lock taken for read. The

test injection causes vma_check_userptr() to call

xe_vma_userptr_force_invalidate(), which feeds into

xe_vma_userptr_do_inval() with drm_gpusvm_ctx.in_notifier=true. That

flag tells drm_gpusvm_unmap_pages() the caller already holds

notifier_lock for write and only asserts the mode. Because the caller

actually holds it for read, the assertion fires:

WARNING: drivers/gpu/drm/drm_gpusvm.c:1669 at \

drm_gpusvm_unmap_pages+0xd4/0x130 [drm_gpusvm_helper]

Call Trace:

xe_vma_userptr_do_inval+0x40d/0xfd0 [xe]

xe_vma_userptr_invalidate_pass1+0x3e6/0x8d0 [xe]

xe_vma_userptr_force_invalidate+0xde/0x290 [xe]

vma_check_userptr.constprop.0+0x1c6/0x220 [xe]

xe_pt_svm_userptr_pre_commit+0x6a3/0xc

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References