CVE-2026-31479

A flaw was found in the Linux kernel's drm/xe driver. During 3D workload processing, a user process can trigger an issue in the Virtual Memory Area (VMA) management when performing a rebind operation. This can lead to an invalid or overlapping VMA insertion, causing the system to enter an unstable state and potentially resulting in a Denial of Service (DoS).

A flaw with MODERATE impact was found in the Linux kernel's Intel xe graphics driver (drm/xe) as shipped in Red Hat Enterprise Linux. While processing VM bind operations issued by a user-space 3D workload, a rebind that splits an existing virtual memory area (VMA) can skip rebinding already-compatible end segments and shrink the original unmap range accordingly. If the bind operation subsequently fails and takes the unwind path, the driver can re-insert a VMA that overlaps those still-present end segments, triggering a kernel WARNING in vm_bind_ioctl_ops_unwind and leaving the GPU virtual memory state inconsistent. A local user able to run graphics workloads can use this to destabilize or crash the kernel, resulting in a denial of service. The vulnerable code entered Red Hat Enterprise Linux with the DRM changes merged from upstream Linux v6.7..v6.8, so Red Hat Enterprise Linux 6, 7, and 8, as well as the RHEL 9.0, 9.2, and 9.4 update streams, are not affected because the vulnerable code is not present. Red Hat Enterprise Linux 9.6 and later update streams, Red Hat Enterprise Linux 10, and Red Hat In-Vehicle OS 2 are affected, and fixes are being pursued through the standard update process for those products. Red Hat's MODERATE rating differs from the higher upstream CVE.org severity because exploitation requires local access and the established failure mode is denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.