CVE-2026-90047

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/xe: Don't hand out the flat CCS storage as usable VRAM

get_flat_ccs_offset() reads the base of the flat CCS storage from the

hardware, scales it by the number of enabled L3 nodes, and rounds the

result up to 128K. Everything below that offset is then handed to the

VRAM allocator as usable memory.

Rounding a limit that means "usable memory ends here" upwards publishes

whatever lies between the real base and the rounded one as free memory,

and that memory belongs to the compression hardware. The scaled value

has no reason to be 128K aligned, and on a Battlemage G21 with 16 GiB it

is not:

flat CCS base: raw 0x3fafff800, rounded 0x3fb000000

so the last 2 KiB of page 0x3fafff000 is CCS storage, in the allocator's

pool. Whatever is allocated there gets that tail overwritten by the

compression hardware, which needs no page-table entry, no buffer object

and no GPU submission to do it, and does it before userspace

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References