CVE-2026-31784

Vulnerability

In the Linux kernel's drm/xe/pxp driver, the function pxp pxp_start` function fails to clear a restart flag after a jump back to the beginning of the function. This oversight causes the function to repeatedly jump back, resulting in an infinite loop [1].

Exploitation

An attacker with local access and the ability to trigger the PXP (Protected Execution Environment) start sequence can exploit this bug. No special privileges beyond normal user access to the graphics subsystem are required, as the vulnerability lies in a kernel function that can be invoked through standard DRM interfaces.

Impact

Successful exploitation leads to a denial of service (DoS) by causing the kernel to hang in an infinite loop, consuming CPU resources and preventing the system from making progress. The PXP functionality from completing. This can render the system unresponsive or cause a soft lockup.

Mitigation

The fix, which clears the restart flag after the jump, has been applied to the Linux kernel stable tree [1]. Users should update to a kernel version containing the commit 0850ec7bb245 (or its backports) to remediate the issue.