Skip to content
Heist/ feed
High

drm/xe: always keep track of remap prev/next

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: drm/xe: always keep track of remap prev/next During 3D workload, user is reporting hitting: [ 413.361679] WARNING: drivers/gpu/drm/xe/xe_vm.c:1217 at vm_bind_ioctl_ops_unwind+0x1e2/0x2e0 [xe], CPU#7: vkd3d_queue/9925 [ 413.361944] CPU: 7 UID: 1000 PID: 9925 Comm: vkd3d_queue Kdump: loaded Not tainted 7.0.0-070000rc3-generic #202603090038 PREEMPT(lazy) [ 413.361949] RIP: 0010:vm_bind_ioctl_ops_unwind+0x1e2/0x2e0 [xe] [ 413.362074] RSP: 0018:ffffd4c25c3df930 EFLAGS: 00010282 [ 413.362077] RAX: 0000000000000000 RBX: ffff8f3ee817ed10 RCX: 0000000000000000 [ 413.362078] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 413.362079] RBP: ffffd4c25c3df980 R08: 0000000000000000 R09: 0000000000000000 [ 413.362081] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8f41fbf99380 [ 413.362082] R13: ffff8f3ee817e968 R14: 00000000ffffffef R15: ffff8f43d00bd380 [ 413.362083] FS: 00000001040ff6c0(0000) GS:ffff8f4696d89000(0000) knlGS:00000000330b0000 [ 413.362085] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 413.362086] CR2: 00007ddfc4747000 CR3: 00000002e6262005 CR4: 0000000000f72ef0 [ 413.362088] PKRU: 55555554 [ 413.362089] Call Trace: [ 413.362092] [ 413.362096] xe_vm_bind_ioctl+0xa9a/0xc60 [xe] Which seems to hint that the vma we are re-inserting for the ops unwind is either invalid or overlapping with something already inserted in the vm. It shouldn't be invalid since this is a re-insertion, so

Announced Source revision 1
Original source ↗

CVE-2026-31479

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-31479

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "8f33b4f054fc29a4774d8d10116ef460faeb84a8",
        "lessThan": "ccd41f110c608b3cc347b9be881c3e72cd634b2b",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "8f33b4f054fc29a4774d8d10116ef460faeb84a8",
        "lessThan": "5eda8001ebb5269755608d678dd1f3928ab077c9",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "8f33b4f054fc29a4774d8d10116ef460faeb84a8",
        "lessThan": "e6ba1749549e87b83c0c4885d84b543687c3740e",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "8f33b4f054fc29a4774d8d10116ef460faeb84a8",
        "lessThan": "bfe9e314d7574d1c5c851972e7aee342733819d2",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "drivers/gpu/drm/xe/xe_pt.c",
      "drivers/gpu/drm/xe/xe_vm.c",
      "drivers/gpu/drm/xe/xe_vm_types.h"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "6.8"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "6.8",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "6.12.80",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.21",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "6.19.11",
        "versionType": "semver",
        "lessThanOrEqual": "6.19.*"
      },
      {
        "status": "unaffected",
        "version": "7.0",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "drivers/gpu/drm/xe/xe_pt.c",
      "drivers/gpu/drm/xe/xe_vm.c",
      "drivers/gpu/drm/xe/xe_vm_types.h"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-31479

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#39906 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement