CVE-2026-90047

A flaw was found in the Linux kernel's drm/xe component. The get_flat_ccs_offset() function, responsible for managing video memory (VRAM), incorrectly calculates available memory. This error allows a portion of memory intended for graphics compression hardware to be allocated for other uses. Consequently, the compression hardware can overwrite data in this allocated VRAM, leading to system instability and a denial of service for a local user.

drm/xe can expose part of flat CCS compression metadata storage as usable VRAM because the CCS boundary is rounded in the wrong direction. Compression hardware may then write metadata into memory that the VRAM allocator already handed out for normal objects, including GPU page tables. This can corrupt GPU address translation state and lead to a black screen or repeated compositor failure, as seen when a Mesa VM level 3 page table landed on the affected page. For the CVSS the PR:L is selected because practical triggering and impact are tied to local GPU use through a graphics session or render node access rather than full administrator privileges. The issue is not network reachable and depends on affected Intel Xe hardware layout and allocator placement, so AC:H is appropriate. Impact is at least local denial of service and integrity corruption of GPU memory.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.