CVE-2026-23466

Vulnerability

The vulnerability resides in the drm/xe driver for Intel GPUs. GGTT MMIO access protection previously relied on hotplug (drm_dev_enter), which works correctly when the driver loads successfully and is later unbound. However, if driver load fails, this protection is insufficient because drm_dev_unplug() is never called. Additionally, devm release functions cannot guarantee that all BOs with GGTT mappings are destroyed before the GGTT MMIO region is removed, as some BOs may be freed asynchronously by worker threads.

Exploitation

Exploitation requires a scenario where the driver load fails. An attacker with local access and the ability to trigger a failed driver load could potentially leverage the race condition between worker threads freeing BOs and the removal of the GGTT MMIO region, leading to a use-after-free condition.

Impact

Successful exploitation could result in memory corruption, which may lead to privilege escalation or denial of service. The vulnerability is rated High with a CVSS v3 score of 7.8, indicating significant impact.

Mitigation

The fix introduces an open-coded flag, protected by the GGTT lock, that guards GGTT MMIO access. The flag is cleared during the dev_fini_ggtt devm release function to ensure MMIO access is disabled once teardown begins. This patch has been applied to the Linux kernel stable tree.