drm/i915/gt: Unmask interrupts only when ACTIVE is true
In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Unmask interrupts only when ACTIVE is true There is a small race window between intel_rps_boost() reading a stale ACTIVE state and queuing rps->work, where ACTIVE may be changed via asynchronous calls triggered by wakeref drop. This means that rps_work() could be triggered after the GT has been parked, so unmasking RPS PM interrupts would happen without holding PM wakelock. This sequence of events may be observed during live_rc6_ctx_wa() selftest: 1) live_rc6_ctx_wa() -> intel_engine_pm_put() -> wakeref_put() ASYNC1) wakeref_put() callback -> __engine_park() -> intel_gt_pm_put_async() -> intel_gt_pm_put_async_untracked() -> intel_wakeref_put_async() ASYNC2) wakeref_put_async() callback -> __gt_park() -> intel_rps_park() -> intel_rps_clear_active() [clear ACTIVE] WITH INTERRUPTS: -> rps_disable_interrupts() -> cancel_work_sync(rps->work) -> rps_reset_interrupts() [rps->pm_iir = 0] WITHOUT INTERRUPTS (TIMER mode): -> rps_stop_timer() -> cancel_work_sync(rps->work) 2) live_rc6_ctx_wa() -> intel_gt_wait_for_idle() -> intel_gt_retire_requests_timeout() -> dma_fence_wait_timeout() -> ops->wait() [i915_fence_wait()] -> i915_request_wait_timeout() -> intel_rps_boost() -> intel_rps_is_active() [check ACTIVE] [OPEN RACE WINDOW] -> queue_work(rps->work) -> retire_requests() -> i915_request_retire() -> intel_rps_dec_waiters() [from 1 to 0] If ASYNC1 and ASYNC2 would execute during [OPEN RACE WINDOW], then: 3
CVE-2026-99005
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-99005
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "3e7abf8141935ded77abeb622480bf4a14241ece",
"lessThan": "77abc1837c9651c8f43f7f7f336d10093eeb7745",
"versionType": "git"
},
{
"status": "affected",
"version": "3e7abf8141935ded77abeb622480bf4a14241ece",
"lessThan": "60f58da15f8c8e39706c564f9251de3626636dce",
"versionType": "git"
},
{
"status": "affected",
"version": "3e7abf8141935ded77abeb622480bf4a14241ece",
"lessThan": "0b4a0fb98b9ffeac36798bbd369c821605cae70f",
"versionType": "git"
},
{
"status": "affected",
"version": "3e7abf8141935ded77abeb622480bf4a14241ece",
"lessThan": "49d349c42cf5ebaa878d02699c632c9d883d935f",
"versionType": "git"
},
{
"status": "affected",
"version": "3e7abf8141935ded77abeb622480bf4a14241ece",
"lessThan": "5346b1cec6afa4f9b4b49a9f84e3cfef95a3f7bb",
"versionType": "git"
}
],
"programFiles": [
"drivers/gpu/drm/i915/gt/intel_rps.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.5"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.5",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/gpu/drm/i915/gt/intel_rps.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-99005
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #52848 · Revision 1
- Added to Heist Feed
- Publisher date