{"id":12300,"date":"2026-09-04T18:54:15","date_gmt":"2026-09-04T10:54:15","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-80606"},"modified":"2026-09-04T18:54:15","modified_gmt":"2026-09-04T10:54:15","slug":"cve-2026-80606","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-80606","title":{"rendered":"CVE-2026-80606 [HIGH] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\ndrm\/xe\/userptr: Hold"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>drm\/xe\/userptr: Hold notifier_lock for write on inject test path<\/p>\n<p>When CONFIG_DRM_XE_USERPTR_INVAL_INJECT=y, xe_pt_svm_userptr_pre_commit()<br \/>\nruns vma_check_userptr() with the svm notifier_lock taken for read. The<br \/>\ntest injection causes vma_check_userptr() to call<br \/>\nxe_vma_userptr_force_invalidate(), which feeds into<br \/>\nxe_vma_userptr_do_inval() with drm_gpusvm_ctx.in_notifier=true. That<br \/>\nflag tells drm_gpusvm_unmap_pages() the caller already holds<br \/>\nnotifier_lock for write and only asserts the mode. Because the caller<br \/>\nactually holds it for read, the assertion fires:<\/p>\n<p>  WARNING: drivers\/gpu\/drm\/drm_gpusvm.c:1669 at<br \/>\n           drm_gpusvm_unmap_pages+0xd4\/0x130 [drm_gpusvm_helper]<br \/>\n  Call Trace:<br \/>\n   xe_vma_userptr_do_inval+0x40d\/0xfd0 [xe]<br \/>\n   xe_vma_userptr_invalidate_pass1+0x3e6\/0x8d0 [xe]<br \/>\n   xe_vma_userptr_force_invalidate+0xde\/0x290 [xe]<br \/>\n   vma_check_userptr.constprop.0+0x1c6\/0x220 [xe]<br \/>\n   xe_pt_svm_userptr_pre_commit+0x6a3\/0xc60 [xe]<br \/>\n   &#8230;<br \/>\n   xe_vm_bind_ioctl+0x3a0a\/0x4480 [xe]<\/p>\n<p>Acquire notifier_lock for write in pre-commit when the inject Kconfig<br \/>\nis enabled, via new helpers xe_pt_svm_userptr_notifier_lock()\/_unlock().<br \/>\nRename xe_svm_assert_held_read() to<br \/>\nxe_svm_assert_held_read_or_inject_write() so it asserts the correct<br \/>\nmode under each build configuration. Production builds<br \/>\n(CONFIG_DRM_XE_USERPTR_INVAL_INJECT=n) keep the existing read-mode<br \/>\nbehavior bit-for-bit.<\/p>\n<p>(cherry picked from commit 80ccbd97ffee8ad2e73167d826fe7be548364365)<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>drm\/xe\/userptr: Hold notifier_lock for write on inject test path<\/p>\n<p>When CONFIG_DRM_XE_USERPTR_INVAL_INJECT=y, xe_pt_svm_userptr_pre_<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-12300","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/12300","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=12300"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=12300"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=12300"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}