Skip to content
Heist/ feed
Unrated

drm/i915/gt: Unmask interrupts only when ACTIVE is true

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Unmask interrupts only when ACTIVE is true There is a small race window between intel_rps_boost() reading a stale ACTIVE state and queuing rps->work, where ACTIVE may be changed via asynchronous calls triggered by wakeref drop. This means that rps_work() could be triggered after the GT has been parked, so unmasking RPS PM interrupts would happen without holding PM wakelock. This sequence of events may be observed during live_rc6_ctx_wa() selftest: 1) live_rc6_ctx_wa() -> intel_engine_pm_put() -> wakeref_put() ASYNC1) wakeref_put() callback -> __engine_park() -> intel_gt_pm_put_async() -> intel_gt_pm_put_async_untracked() -> intel_wakeref_put_async() ASYNC2) wakeref_put_async() callback -> __gt_park() -> intel_rps_park() -> intel_rps_clear_active() [clear ACTIVE] WITH INTERRUPTS: -> rps_disable_interrupts() -> cancel_work_sync(rps->work) -> rps_reset_interrupts() [rps->pm_iir = 0] WITHOUT INTERRUPTS (TIMER mode): -> rps_stop_timer() -> cancel_work_sync(rps->work) 2) live_rc6_ctx_wa() -> intel_gt_wait_for_idle() -> intel_gt_retire_requests_timeout() -> dma_fence_wait_timeout() -> ops->wait() [i915_fence_wait()] -> i915_request_wait_timeout() -> intel_rps_boost() -> intel_rps_is_active() [check ACTIVE] [OPEN RACE WINDOW] -> queue_work(rps->work) -> retire_requests() -> i915_request_retire() -> intel_rps_dec_waiters() [from 1 to 0] If ASYNC1 and ASYNC2 would execute during [OPEN RACE WINDOW], then: 3

Announced Source revision 1
Original source ↗

CVE-2026-99005

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-99005

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "3e7abf8141935ded77abeb622480bf4a14241ece",
        "lessThan": "77abc1837c9651c8f43f7f7f336d10093eeb7745",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "3e7abf8141935ded77abeb622480bf4a14241ece",
        "lessThan": "60f58da15f8c8e39706c564f9251de3626636dce",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "3e7abf8141935ded77abeb622480bf4a14241ece",
        "lessThan": "0b4a0fb98b9ffeac36798bbd369c821605cae70f",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "3e7abf8141935ded77abeb622480bf4a14241ece",
        "lessThan": "49d349c42cf5ebaa878d02699c632c9d883d935f",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "3e7abf8141935ded77abeb622480bf4a14241ece",
        "lessThan": "5346b1cec6afa4f9b4b49a9f84e3cfef95a3f7bb",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "drivers/gpu/drm/i915/gt/intel_rps.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "5.5"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "5.5",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "6.6.160",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.113",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.57",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "7.2.11",
        "versionType": "semver",
        "lessThanOrEqual": "7.2.*"
      },
      {
        "status": "unaffected",
        "version": "7.3",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "drivers/gpu/drm/i915/gt/intel_rps.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-99005

Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event
#52848 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement