CVE-2026-98106

A flaw was found in the Linux kernel's Direct Rendering Manager (DRM) pagemap component. A race condition during memory migration allows a local user to cause a Denial of Service (DoS). When device-private memory is migrated to system memory during a page fault, a timing window permits an eviction process to concurrently attempt migrating the same memory folio again. This double migration leaves internal memory tracking lists in an inconsistent state, causing the kernel to retry locks indefinitely and resulting in a system lockup.

A moderate-severity flaw was found in the Linux kernel's Direct Rendering Manager (DRM) pagemap subsystem. When device-private memory is migrated to system memory during a CPU page fault, the folio can remain reachable through the raw-PFN eviction path until migration finalization drops the source reference. If the eviction path selects the same folio during this timing window, it can be migrated a second time; this double migration can leave an uncharged folio on an LRU list, causing folio_lruvec_lock_irqsave() to retry indefinitely and resulting in a soft lockup and RCU stall. A local user with access to the affected DRM/GPU device (for example, by performing GPU shared virtual memory operations with the Intel Xe driver) can win this race and cause a system-wide denial of service. There is no impact to confidentiality or integrity (Red Hat CVSS 3.1: 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

The vulnerable code entered Red Hat kernels with the DRM merge of upstream v6.14..v6.15, so Red Hat Enterprise Linux 6, 7, and 8, earlier RHEL 9 update streams (through RHEL 9.6), earlier RHEL 10 streams, and OpenShift Container Platform releases built on kernels without this code are not affected because the vulnerable code is not present. For the affected Red Hat Enterprise Linux 9 (9.8 and later), RHEL 10 (10.2 and later), Red Hat In-Vehicle OS 2, and OpenShift Container Platform 4.22/4.23 and 5.x streams, the fix is deferred to a future maintenance update because this flaw only allows a local denial of service with no confidentiality or integrity impact and requires winning a narrow race window from local GPU/DRM device access. The residual risk is that a local user could trigger repeated soft lockups and RCU stalls, leaving the affected system unresponsive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.