CVE-2026-98391

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98391", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.346Z", "datePublished": "2026-10-14T13:25:55.498Z", "dateUpdated": "2026-10-19T09:18:42.391Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:18:42.391Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Guard page-fault worker with runtime PM check\n\nDuring VM teardown, the VM's runtime PM reference is dropped\nasynchronously, allowing the device to autosuspend while stale page\nfaults belonging to the now-dead VM are still queued. When the\npage-fault worker later tries to ack one of these, it calls into\nguc_ct_send_locked() on an already-suspended device, tripping:\n\n\u00a0 Assertion `!xe_pm_runtime_suspended(xe)` failed!\n\u00a0 WARNING at xe_device.c:1267 xe_device_assert_mem_access+0x11c/0x140 [xe]\n\nA live VM/exec queue always holds a PM reference while it has\noutstanding work, so if the device is suspended at ack time, the\nowning context is already gone and the fault is stale.\n\nTake a runtime PM reference across the entire pagefault\nqueue worker to safely deliver acks for torn-down VMs.\n\nv3:\n - Move PM ref to the generic xe_pagefault_queue_work using\n guard(xe_pm_runtime)(xe) instead of tracking it in the GuC\n backend(Matt Brost).\n\nv2:\n - Hold PM ref across the entire batch (begin/end) instead of per-ack.\n This prevents the device from autosuspending mid-batch, which would\n leave write_only acks written but the end flush skipped, and skip\n counter++, desyncing the cadence check.(Himal)\n - Add a comment explaining stale faults.(Himal)\n\n(cherry picked from commit fcc2431d2213dc4d04250c4f1ae87d9c3ae0d455)\n[Rodrigo: Added xe_device struct for compatibility while cherry-picking]"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/xe/xe_pagefault.c", "drivers/gpu/drm/xe/xe_pagefault_types.h"], "versions": [{"version": "f289f7807119128d4f9d59f34ac557549c7562e5", "lessThan": "25764620ec64c0142e2c87c41787f45540cf09ff", "status": "affected", "versionType": "git"}, {"version": "f289f7807119128d4f9d59f34ac557549c7562e5", "lessThan": "20fce5b34b21a995839743b4917a1edd2fd503ba", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/xe/xe_pagefault.c", "drivers/gpu/drm/xe/xe_pagefault_types.h"], "versions": [{"version": "6.19", "status": "affected"}, {"version": "0", "lessThan": "6.19", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/25764620ec64c0142e2c87c41787f45540cf09ff"}, {"url": "https://git.kernel.org/stable/c/20fce5b34b21a995839743b4917a1edd2fd503ba"}], "title": "drm/xe: Guard page-fault worker with runtime PM check", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/xe/xe_pagefault.c", "drivers/gpu/drm/xe/xe_pagefault_types.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "25764620ec64c0142e2c87c41787f45540cf09ff", "status": "affected", "version": "f289f7807119128d4f9d59f34ac557549c7562e5", "versionType": "git"}, {"lessThan": "20fce5b34b21a995839743b4917a1edd2fd503ba", "status": "affected", "version": "f289f7807119128d4f9d59f34ac557549c7562e5", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/xe/xe_pagefault.c", "drivers/gpu/drm/xe/xe_pagefault_types.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.19"}, {"lessThan": "6.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Guard page-fault worker with runtime PM check\n\nDuring VM teardown, the VM's runtime PM reference is dropped\nasynchronously, allowing the device to autosuspend while stale page\nfaults belonging to the now-dead VM are still queued. When the\npage-fault worker later tries to ack one of these, it calls into\nguc_ct_send_locked() on an already-suspended device, tripping:\n\n\u00a0 Assertion `!xe_pm_runtime_suspended(xe)` failed!\n\u00a0 WARNING at xe_device.c:1267 xe_device_assert_mem_access+0x11c/0x140 [xe]\n\nA live VM/exec queue always holds a PM reference while it has\noutstanding work, so if the device is suspended at ack time, the\nowning context is already gone and the fault is stale.\n\nTake a runtime PM reference across the entire pagefault\nqueue worker to safely deliver acks for torn-down VMs.\n\nv3:\n - Move PM ref to the generic xe_pagefault_queue_work using\n guard(xe_pm_runtime)(xe) instead of tracking it in the GuC\n backend(Matt Brost).\n\nv2:\n - Hold PM ref across the entire batch (begin/end) instead of per-ack.\n This prevents the device from autosuspending mid-batch, which would\n leave write_only acks written but the end flush skipped, and skip\n counter++, desyncing the cadence check.(Himal)\n - Add a comment explaining stale faults.(Himal)\n\n(cherry picked from commit fcc2431d2213dc4d04250c4f1ae87d9c3ae0d455)\n[Rodrigo: Added xe_device struct for compatibility while cherry-picking]"}], "id": "CVE-2026-98391", "lastModified": "2026-10-19T10:18:42.400", "metrics": {}, "published": "2026-10-14T14:17:49.980", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/20fce5b34b21a995839743b4917a1edd2fd503ba"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/25764620ec64c0142e2c87c41787f45540cf09ff"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: drm/xe: Guard page-fault worker with runtime PM check", "id": "2552226", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2552226"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-617", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/xe: Guard page-fault worker with runtime PM check\nDuring VM teardown, the VM's runtime PM reference is dropped\nasynchronously, allowing the device to autosuspend while stale page\nfaults belonging to the now-dead VM are still queued. When the\npage-fault worker later tries to ack one of these, it calls into\nguc_ct_send_locked() on an already-suspended device, tripping:\n\u00a0 Assertion `!xe_pm_runtime_suspended(xe)` failed!\n\u00a0 WARNING at xe_device.c:1267 xe_device_assert_mem_access+0x11c/0x140 [xe]\nA live VM/exec queue always holds a PM reference while it has\noutstanding work, so if the device is suspended at ack time, the\nowning context is already gone and the fault is stale.\nTake a runtime PM reference across the entire pagefault\nqueue worker to safely deliver acks for torn-down VMs.\nv3:\n- Move PM ref to the generic xe_pagefault_queue_work using\nguard(xe_pm_runtime)(xe) instead of tracking it in the GuC\nbackend(Matt Brost).\nv2:\n- Hold PM ref across the entire batch (begin/end) instead of per-ack.\nThis prevents the device from autosuspending mid-batch, which would\nleave write_only acks written but the end flush skipped, and skip\ncounter++, desyncing the cadence check.(Himal)\n- Add a comment explaining stale faults.(Himal)\n(cherry picked from commit fcc2431d2213dc4d04250c4f1ae87d9c3ae0d455)\n[Rodrigo: Added xe_device struct for compatibility while cherry-picking]", "A flaw was found in the Linux kernel's Intel Xe graphics driver. During graphics virtual memory teardown, the driver asynchronously releases its runtime power management reference, allowing the graphics device to enter a suspended state while page-fault events remain queued. When the driver attempts to process these pending events on the suspended hardware, an assertion failure occurs. A local user could trigger this vulnerability to cause a kernel crash, resulting in a denial of service (DoS)."], "name": "CVE-2026-98391", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-14T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98391\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98391\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98391.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f289f7807119128d4f9d59f34ac557549c7562e5,25764620ec64c0142e2c87c41787f45540cf09ff)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f289f7807119128d4f9d59f34ac557549c7562e5,20fce5b34b21a995839743b4917a1edd2fd503ba)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-15T05:15:14.984738+00:00", "updated": "2026-10-19T17:45:13.621040+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}