Kestrel
대시보드로 돌아가기
CVE-2026-98391UNKNOWNMITRENVD대응게시일: 2026. 10. 14.수정일: 2026. 10. 14.CNA: 416baaa9-dc9f-4396-8d5f-8c081fb06d67Received

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Guard page-fault worker with runtime PM check During VM teardo

위협 신호 · CVSS · EPSS · KEV

정기 패치· 높은 악용 신호 없음
CVSS
—unknown

이론적 심각도 점수

EPSS
0.2%상위 91.1%

30일 내 악용 확률 예측

KEV
미등재

실측 악용 기록 없음

권장 대응 기한60일 이내CISA SSVC 기준

계획된 패치 주기 내 조치(60일 이내)

외부 노출· KEV 미등재 · 자동화 어려움 · 부분 영향 · 외부 노출

CVSS 벡터 · 메트릭

CVSS 벡터 정보 없음

상세 설명

In the Linux kernel, the following vulnerability has been resolved:

drm/xe: Guard page-fault worker with runtime PM check

During VM teardown, the VM's runtime PM reference is dropped
asynchronously, allowing the device to autosuspend while stale page
faults belonging to the now-dead VM are still queued. When the
page-fault worker later tries to ack one of these, it calls into
guc_ct_send_locked() on an already-suspended device, tripping:

  Assertion !xe_pm_runtime_suspended(xe) failed!
  WARNING at xe_device.c:1267 xe_device_assert_mem_access+0x11c/0x140 [xe]

A live VM/exec queue always holds a PM reference while it has
outstanding work, so if the device is suspended at ack time, the
owning context is already gone and the fault is stale.

Take a runtime PM reference across the entire pagefault
queue worker to safely deliver acks for torn-down VMs.

v3:

  • Move PM ref to the generic xe_pagefault_queue_work using
    guard(xe_pm_runtime)(xe) instead of tracking it in the GuC
    backend(Matt Brost).

v2:

  • Hold PM ref across the entire batch (begin/end) instead of per-ack.
    This prevents the device from autosuspending mid-batch, which would
    leave write_only acks written but the end flush skipped, and skip
    counter++, desyncing the cadence check.(Himal)
  • Add a comment explaining stale faults.(Himal)

(cherry picked from commit fcc2431d2213dc4d04250c4f1ae87d9c3ae0d455)
[Rodrigo: Added xe_device struct for compatibility while cherry-picking]

AI 심층 분석

공격 시나리오 · 재현 가능한 PoC 페이로드 · 즉시 적용 가능한 차단 패치를 한 번에 받아 보세요. 보안 운영팀이 그대로 점검·티켓팅에 쓸 수 있는 형태로 정리해 드립니다.