Skip to content
Heist/ feed
Unrated

drm/xe/shrinker: Take a runtime PM ref before shrinking non-system memory

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: drm/xe/shrinker: Take a runtime PM ref before shrinking non-system memory __xe_shrinker_walk() walks the SYSTEM and TT LRUs without a runtime PM reference. Shrinking a bo outside system memory invalidates its GPU mappings, which needs the device resumed, so while it is runtime suspended the page table zap trips an assert and the TLB invalidation returns -ENODEV: WARNING: drivers/gpu/drm/xe/xe_bo.c:770 at xe_bo_move_notify+0x1fc/0x450 [xe] xe_bo_shrink+0x20f/0x2b0 [xe] __xe_shrinker_walk+0x174/0x410 [xe] xe_shrinker_scan+0x10c/0x1e0 [xe] do_shrink_slab+0x176/0x7e0 drop_caches_sysctl_handler+0x9c/0xf0 Take a reference before walking a memory type other than XE_PL_SYSTEM and stop there if it cannot be acquired. Reuse the shrinker's existing acquire path, which resumes the device directly where reclaim allows that and otherwise queues the PM worker for a later scan. Stop the walk once the scan target is met, so a satisfied scan does not wake the device. System memory is still reclaimed while the device is suspended. Gate this on xe_device_is_l2_flush_optimized(), the same condition under which xe_bo_trigger_rebind() issues the invalidation for a non-fault-mode vm, so reclaim is unaffected elsewhere. The System CCS copy already has its own reference in xe_bo_shrink(). Only a non-fault-mode vm can reach this, since a fault-mode vm requires LR mode and that holds a runtime PM reference for the vm's lifetime. Reprodu

Announced Group revision 1
Original source ↗

CVE-2026-98310

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-98310

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "4e7ebff69aed345f65f590a17b3119c0cb5eadde",
        "lessThan": "b7f4d2588b1342bb190c04b3d7a32560f206c74c",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "4e7ebff69aed345f65f590a17b3119c0cb5eadde",
        "lessThan": "985862be16c7e4da808c51f393d631fb60c0be5c",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "drivers/gpu/drm/xe/xe_shrinker.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "7.1"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "7.1",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "7.2.8",
        "versionType": "semver",
        "lessThanOrEqual": "7.2.*"
      },
      {
        "status": "unaffected",
        "version": "7.3",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "drivers/gpu/drm/xe/xe_shrinker.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-98310

Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event
#38389 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement