SB20260816274 - Race condition in Linux kernel drm xe driver

Description

This security bulletin contains information about 1 vulnerability.

1) Race condition (CVE-ID: CVE-2026-74440)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read or write memory being moved.

The vulnerability exists due to a race condition in xe_exec_ioctl() when scheduling user jobs that use external buffer objects mapped by the VM without waiting on their dma-resv KERNEL fences. A local user can submit a job using an external buffer object while a kernel operation on that buffer object is still in flight to read or write memory being moved.

Long-running mode is excluded from this behavior.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/1738db550334adca0e7fcf0ef684198fb7462779
• https://git.kernel.org/stable/c/21976fe5258494ac38b63d103be81bf1180ae4ae
• https://git.kernel.org/stable/c/5d363d00bc9799b90a0dc89eb1c5dcb909c042ee
• https://git.kernel.org/stable/c/af80e2bfde9312c76b60cf9274248dce0410b30d