CVE-2026-80606

A flaw was found in the Linux kernel's drm/xe/userptr component. When a specific test configuration is enabled, the system attempts to perform a write operation while holding a read-only lock. This incorrect lock handling leads to an assertion failure, which can cause system instability or a denial of service (DoS) due to a kernel crash.

A low impact flaw was found in the Linux kernel drm/xe/userptr driver. When the test-only kernel configuration option CONFIG_DRM_XE_USERPTR_INVAL_INJECT is enabled, xe_pt_svm_userptr_pre_commit() runs vma_check_userptr() while holding the SVM notifier_lock for read, but the userptr invalidation injection path requires that lock for write. This incorrect lock mode triggers an assertion failure in drm_gpusvm_unmap_pages() that can crash the kernel, resulting in a local denial of service. A local user with access to the DRM device can trigger this path through the VM bind ioctl. Only availability is affected; there is no impact on confidentiality or integrity. Production builds, which ship with CONFIG_DRM_XE_USERPTR_INVAL_INJECT disabled, keep the existing read-lock behavior and are not affected, which is why the Red Hat affected-product scope distinguishes builds that enable this test configuration. Because the flaw is limited to a test-injection code path and to availability impact, Red Hat rates its severity lower (impact LOW, CVSS 5.5) than the upstream CVEORG score of 7.8.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.