CVE-2026-74440

A flaw was found in the Linux kernel's drm/xe driver. The xe_exec_ioctl() function did not properly wait on kernel fences for external Buffer Objects (BOs). This oversight allows a local attacker to initiate a user job that races with ongoing kernel memory management operations on external BOs. A successful exploit could lead to memory corruption, potentially resulting in information disclosure or system instability.

drm xe exec ioctl could arm a user GPU job after waiting only on the VM dma resv KERNEL slot while skipping KERNEL fences on external BOs. External BOs carry eviction, move, and other memory management operations in their own dma resv KERNEL slots, so a submitted job could race those kernel operations and access BO memory while it is being moved. For the CVSS the PR:L value is used because a local user or process with access to the DRM render node can submit exec ioctls in typical deployments. The issue is not directly network reachable and requires local GPU driver access. Impact is at least denial of service or GPU memory corruption, and the worst defensible interpretation includes confidentiality and integrity impact because the race can involve reading or writing memory during BO migration.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.