CVE-2026-93248

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: drm/xe: don't WARN on kernel job timeout when device already wedged igt@xe_wedged@wedged-at-any-timeout wedges the device in mode 2 (UPON_ANY_HANG_NO_RESET) and then rebinds the driver. During unbind, a GSC proxy kernel submission can still time out; with the device wedged and the GuC CT stopped it can never complete, so its kernel job times out. Tile0: GT1: Kernel-submitted job timed out WARNING: drivers/gpu/drm/xe/xe_guc_submit.c:... at guc_exec_queue_timedout_job() Workqueue: gt-ordered-wq drm_sched_job_timedout Killed queues skip guc_submit_hint_wedged(), leaving 'wedged' false even though the device is already wedged. The timeout handler then treats the kernel queue timeout as unexpected and taints the kernel. Honour an already-wedged device even for killed queues so the expected teardown timeout no longer trips the WARN. (cherry picked from commit a1c1dbd0f047bb05de6aaf6abe9103031179bf19)

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Published

2026-09-24 16:17:20.963000

Last modified

2026-10-19 10:17:16.030000

View original CVE JSON

{
  "id": "CVE-2026-93248",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-09-24T16:17:20.963",
  "lastModified": "2026-10-19T10:17:16.030",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: don't WARN on kernel job timeout when device already wedged\n\nigt@xe_wedged@wedged-at-any-timeout wedges the device in mode 2\n(UPON_ANY_HANG_NO_RESET) and then rebinds the driver. During unbind,\na GSC proxy kernel submission can still time out; with the device wedged\nand the GuC CT stopped it can never complete, so its kernel job times out.\n\n  Tile0: GT1: Kernel-submitted job timed out\n  WARNING: drivers/gpu/drm/xe/xe_guc_submit.c:...\n\t   at guc_exec_queue_timedout_job()\n  Workqueue: gt-ordered-wq drm_sched_job_timedout\n\nKilled queues skip guc_submit_hint_wedged(), leaving 'wedged' false even\nthough the device is already wedged. The timeout handler then treats the\nkernel queue timeout as unexpected and taints the kernel.\n\nHonour an already-wedged device even for killed queues so the expected\nteardown timeout no longer trips the WARN.\n\n(cherry picked from commit a1c1dbd0f047bb05de6aaf6abe9103031179bf19)"
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_guc_submit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "5a2f117a80c207372513ca8964eeb178874f4990",
              "lessThan": "041cce629a08d4a2f1a28ec61a105b26b7f047e6",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "5a2f117a80c207372513ca8964eeb178874f4990",
              "lessThan": "24d81b72992006f9c390f1fc85c7f991e6d06fd6",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "5a2f117a80c207372513ca8964eeb178874f4990",
              "lessThan": "13087ad7817e6e5f210064518bfc4d6d58a9c2f3",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_guc_submit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "6.17",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "6.17",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18.57",
              "lessThanOrEqual": "6.18.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.2.6",
              "lessThanOrEqual": "7.2.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.3",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/041cce629a08d4a2f1a28ec61a105b26b7f047e6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/13087ad7817e6e5f210064518bfc4d6d58a9c2f3",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/24d81b72992006f9c390f1fc85c7f991e6d06fd6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}