CVE-2026-63863

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63863", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.017Z", "datePublished": "2026-07-19T14:04:49.967Z", "dateUpdated": "2026-10-19T20:17:53.141Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:36:39.194Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gpusvm: Fix unbalanced unlock in drm_gpusvm_scan_mm()\n\nThere is a unbalanced lock/unlock to gpusvm notifier lock:\n[ 931.045868] =====================================\n[ 931.046509] WARNING: bad unlock balance detected!\n[ 931.047149] 6.19.0-rc6+xe-**************** #9 Tainted: G U\n[ 931.048150] -------------------------------------\n[ 931.048790] kworker/u5:0/51 is trying to release lock (&gpusvm->notifier_lock) at:\n[ 931.049801] [<ffffffffa090c0d8>] drm_gpusvm_scan_mm+0x188/0x460 [drm_gpusvm_helper]\n[ 931.050802] but there are no more locks to release!\n[ 931.051463]\n\nThe drm_gpusvm_notifier_unlock() sits under err_free label and the\nfirst jump to err_free is just before calling the\ndrm_gpusvm_notifier_lock() causing unbalanced unlock."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is only reached via Intel Xe DRM ioctls (DRM_XE_VM_BIND prefetch, GPU page-fault handling) on /dev/dri/renderD*, which require local access to the GPU device node.\nAC:L - An attacker can reliably trigger the bug by racing CPU memory operations (munmap/mremap/mprotect) against GPU SVM VRAM migration to force hmm_range_fault() to return an error or time out on -EBUSY, hitting the err_free path without holding notifier_lock.\nPR:L - Exploitation requires opening the DRM render node (DRM_RENDER_ALLOW), which is available to unprivileged users in the render group on typical desktop and cloud GPU instances, not root or capabilities.\nUI:N - No victim interaction is required; the attacker triggers the condition through their own GPU VM bindings, compute submissions, and concurrent memory manipulation.\nS:C - Corrupting notifier_lock breaks the documented IOMMU security model for GPU SVM, allowing GPU DMA operations to proceed without proper invalidation synchronization and potentially accessing host memory outside the attacker's GPU context.\nC:H - Rwsem corruption from the spurious unlock can desynchronize invalidation from migration, enabling races where the GPU reads stale or freed pages that may have been reallocated, constituting arbitrary memory disclosure.\nI:H - The same lock corruption can allow GPU DMA writes to pages during or after invalidation races, providing a path to arbitrary memory corruption and potential privilege escalation.\nA:H - The bug triggers a kernel lockdep warning (\"bad unlock balance detected\") and rwsem corruption can cause kernel oops, hangs, or panic during subsequent notifier_lock operations."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/drm_gpusvm.c"], "versions": [{"version": "f1d08a5864822684773105c60528e2abb577ca6c", "lessThan": "8efaa47a871662a8c21b819cec60786f7ef17ab4", "status": "affected", "versionType": "git"}, {"version": "f1d08a5864822684773105c60528e2abb577ca6c", "lessThan": "d287dee565c3c32e1ed76ec1847af46809c29b90", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/drm_gpusvm.c"], "versions": [{"version": "7.0", "status": "affected"}, {"version": "0", "lessThan": "7.0", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.10", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndExcluding": "7.0.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/8efaa47a871662a8c21b819cec60786f7ef17ab4"}, {"url": "https://git.kernel.org/stable/c/d287dee565c3c32e1ed76ec1847af46809c29b90"}], "title": "drm/gpusvm: Fix unbalanced unlock in drm_gpusvm_scan_mm()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63863", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:32:32.141561Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-667", "description": "CWE-667 Improper Locking"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T20:17:53.141Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63863", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:32:32.141561Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:32:32.837Z"}}], "cna": {"title": "drm/gpusvm: Fix unbalanced unlock in drm_gpusvm_scan_mm()", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is only reached via Intel Xe DRM ioctls (DRM_XE_VM_BIND prefetch, GPU page-fault handling) on /dev/dri/renderD*, which require local access to the GPU device node.\nAC:L - An attacker can reliably trigger the bug by racing CPU memory operations (munmap/mremap/mprotect) against GPU SVM VRAM migration to force hmm_range_fault() to return an error or time out on -EBUSY, hitting the err_free path without holding notifier_lock.\nPR:L - Exploitation requires opening the DRM render node (DRM_RENDER_ALLOW), which is available to unprivileged users in the render group on typical desktop and cloud GPU instances, not root or capabilities.\nUI:N - No victim interaction is required; the attacker triggers the condition through their own GPU VM bindings, compute submissions, and concurrent memory manipulation.\nS:C - Corrupting notifier_lock breaks the documented IOMMU security model for GPU SVM, allowing GPU DMA operations to proceed without proper invalidation synchronization and potentially accessing host memory outside the attacker's GPU context.\nC:H - Rwsem corruption from the spurious unlock can desynchronize invalidation from migration, enabling races where the GPU reads stale or freed pages that may have been reallocated, constituting arbitrary memory disclosure.\nI:H - The same lock corruption can allow GPU DMA writes to pages during or after invalidation races, providing a path to arbitrary memory corruption and potential privilege escalation.\nA:H - The bug triggers a kernel lockdep warning (\"bad unlock balance detected\") and rwsem corruption can cause kernel oops, hangs, or panic during subsequent notifier_lock operations."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "f1d08a5864822684773105c60528e2abb577ca6c", "lessThan": "8efaa47a871662a8c21b819cec60786f7ef17ab4", "versionType": "git"}, {"status": "affected", "version": "f1d08a5864822684773105c60528e2abb577ca6c", "lessThan": "d287dee565c3c32e1ed76ec1847af46809c29b90", "versionType": "git"}], "programFiles": ["drivers/gpu/drm/drm_gpusvm.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "7.0"}, {"status": "unaffected", "version": "0", "lessThan": "7.0", "versionType": "semver"}, {"status": "unaffected", "version": "7.0.10", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/gpu/drm/drm_gpusvm.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/8efaa47a871662a8c21b819cec60786f7ef17ab4"}, {"url": "https://git.kernel.org/stable/c/d287dee565c3c32e1ed76ec1847af46809c29b90"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gpusvm: Fix unbalanced unlock in drm_gpusvm_scan_mm()\n\nThere is a unbalanced lock/unlock to gpusvm notifier lock:\n[ 931.045868] =====================================\n[ 931.046509] WARNING: bad unlock balance detected!\n[ 931.047149] 6.19.0-rc6+xe-**************** #9 Tainted: G U\n[ 931.048150] -------------------------------------\n[ 931.048790] kworker/u5:0/51 is trying to release lock (&gpusvm->notifier_lock) at:\n[ 931.049801] [<ffffffffa090c0d8>] drm_gpusvm_scan_mm+0x188/0x460 [drm_gpusvm_helper]\n[ 931.050802] but there are no more locks to release!\n[ 931.051463]\n\nThe drm_gpusvm_notifier_unlock() sits under err_free label and the\nfirst jump to err_free is just before calling the\ndrm_gpusvm_notifier_lock() causing unbalanced unlock."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.10", "versionStartIncluding": "7.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1", "versionStartIncluding": "7.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:36:39.194Z"}}}, "cveMetadata": {"cveId": "CVE-2026-63863", "state": "PUBLISHED", "dateUpdated": "2026-10-19T20:17:53.141Z", "dateReserved": "2026-07-19T07:54:57.017Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-07-19T14:04:49.967Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/drm_gpusvm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "8efaa47a871662a8c21b819cec60786f7ef17ab4", "status": "affected", "version": "f1d08a5864822684773105c60528e2abb577ca6c", "versionType": "git"}, {"lessThan": "d287dee565c3c32e1ed76ec1847af46809c29b90", "status": "affected", "version": "f1d08a5864822684773105c60528e2abb577ca6c", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/drm_gpusvm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.0"}, {"lessThan": "7.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2108AD68-1941-4FEE-96A2-DA53D847EC08", "versionEndExcluding": "7.0.10", "versionStartIncluding": "7.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gpusvm: Fix unbalanced unlock in drm_gpusvm_scan_mm()\n\nThere is a unbalanced lock/unlock to gpusvm notifier lock:\n[ 931.045868] =====================================\n[ 931.046509] WARNING: bad unlock balance detected!\n[ 931.047149] 6.19.0-rc6+xe-**************** #9 Tainted: G U\n[ 931.048150] -------------------------------------\n[ 931.048790] kworker/u5:0/51 is trying to release lock (&gpusvm->notifier_lock) at:\n[ 931.049801] [<ffffffffa090c0d8>] drm_gpusvm_scan_mm+0x188/0x460 [drm_gpusvm_helper]\n[ 931.050802] but there are no more locks to release!\n[ 931.051463]\n\nThe drm_gpusvm_notifier_unlock() sits under err_free label and the\nfirst jump to err_free is just before calling the\ndrm_gpusvm_notifier_lock() causing unbalanced unlock."}], "id": "CVE-2026-63863", "lastModified": "2026-10-26T17:00:22.240", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63863", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:32:32.141561Z", "version": "2.0.3"}}]}, "published": "2026-07-19T15:16:53.200", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8efaa47a871662a8c21b819cec60786f7ef17ab4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d287dee565c3c32e1ed76ec1847af46809c29b90"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-667"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-667"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: drm/gpusvm: Fix unbalanced unlock in drm_gpusvm_scan_mm()", "id": "2502294", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502294"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-832", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/gpusvm: Fix unbalanced unlock in drm_gpusvm_scan_mm()\nThere is a unbalanced lock/unlock to gpusvm notifier lock:\n[ 931.045868] =====================================\n[ 931.046509] WARNING: bad unlock balance detected!\n[ 931.047149] 6.19.0-rc6+xe-**************** #9 Tainted: G U\n[ 931.048150] -------------------------------------\n[ 931.048790] kworker/u5:0/51 is trying to release lock (&gpusvm->notifier_lock) at:\n[ 931.049801] [<ffffffffa090c0d8>] drm_gpusvm_scan_mm+0x188/0x460 [drm_gpusvm_helper]\n[ 931.050802] but there are no more locks to release!\n[ 931.051463]\nThe drm_gpusvm_notifier_unlock() sits under err_free label and the\nfirst jump to err_free is just before calling the\ndrm_gpusvm_notifier_lock() causing unbalanced unlock.", "A flaw was found in the Linux kernel's Direct Rendering Manager (DRM) Graphics Processing Unit Shared Virtual Memory (gpusvm) component. This vulnerability is caused by an unbalanced lock and unlock operation, which can lead to system instability. An attacker could potentially exploit this to trigger a denial of service, making the system unresponsive."], "name": "CVE-2026-63863", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-63863\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63863\nhttps://lore.kernel.org/linux-cve-announce/2026071934-CVE-2026-63863-7079@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f1d08a5864822684773105c60528e2abb577ca6c,8efaa47a871662a8c21b819cec60786f7ef17ab4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f1d08a5864822684773105c60528e2abb577ca6c,d287dee565c3c32e1ed76ec1847af46809c29b90)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.10,8.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-21T03:15:02.662710+00:00", "updated": "2026-10-20T08:45:07.978036+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}