CVE-2026-90064

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Reject page faults from non-fault-mode scratch VMs Having scratch enabled does not make a VM capable of handling recoverable page faults. Allowing scratch VMs through the ASID lookup also admits dma-fence mode VMs. If such a VM faults on an already valid VMA, the handler reports success without fixing the fault, causing the GPU to retry indefinitely. Only allow fault-mode VMs through the ASID lookup. Fault-mode VMs using scratch remain supported, while faults from 3D VMs are rejected. (cherry picked from commit bfb24a06405b652d37831f3fb66b71d33a6605de)

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Published

2026-09-17 17:16:55.220000

Last modified

2026-10-19 09:18:54.887000

View original CVE JSON

{
  "id": "CVE-2026-90064",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-09-17T17:16:55.220",
  "lastModified": "2026-10-19T09:18:54.887",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Reject page faults from non-fault-mode scratch VMs\n\nHaving scratch enabled does not make a VM capable of handling recoverable\npage faults. Allowing scratch VMs through the ASID lookup also admits\ndma-fence mode VMs.\n\nIf such a VM faults on an already valid VMA, the handler reports success\nwithout fixing the fault, causing the GPU to retry indefinitely.\n\nOnly allow fault-mode VMs through the ASID lookup. Fault-mode VMs using\nscratch remain supported, while faults from 3D VMs are rejected.\n\n(cherry picked from commit bfb24a06405b652d37831f3fb66b71d33a6605de)"
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_pagefault.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "ad9843aac91a1eda12912a4922042ea04cfc29dc",
              "lessThan": "905d648e97ef3a291f71a935a7fab0133f27f0f7",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "ad9843aac91a1eda12912a4922042ea04cfc29dc",
              "lessThan": "5e977521d21717edb8e91d004434697d6e3f248c",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_pagefault.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "7.1",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "7.1",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.2.6",
              "lessThanOrEqual": "7.2.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.3",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/5e977521d21717edb8e91d004434697d6e3f248c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/905d648e97ef3a291f71a935a7fab0133f27f0f7",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}