CVE-2024-37026

What it actually does

Race condition in drm/xe allows migration exec queue to share BCS instances with user jobs; GuC scheduling queue depth of 2 permits a migration job to block behind a fault, deadlocking the page-fault servicing path required by USM.

Why it matters to the business

Systems using Intel Xe GPUs with unified shared memory may experience kernel deadlocks or hangs during GPU memory migration, disrupting graphics workloads and requiring reboots; low immediate risk given absence from known exploited lists and stable low exploit probability.

How an attack unfolds

An attacker crafts GPU workloads that interleave user submissions with USM page faults on shared BCS engines; the two-deep GuC queue causes the migration job to stall behind a faulting user job, preventing the migrate queue from servicing the fault and producing deadlock.

How to fix it

Update the Linux kernel to a version containing commit 92deed4a9bfd9ef187764225bba530116c49e15c or later; rebuild and deploy the fixed drm/xe driver; reboot systems after kernel upgrade.

How to confirm the fix worked

Confirm kernel git revision contains 92deed4a9bfd9ef187764225bba530116c49e15c; run targeted USM migration stress tests under concurrent GPU load and verify absence of deadlock; monitor dmesg for drm/xe scheduling warnings.

Typical attack path

1. Obtain local access or execute unprivileged GPU code on affected Xe hardware
2. Trigger concurrent user jobs and USM page faults that map to the same BCS instance
3. Cause migration job to enqueue behind faulting job in the 2-deep GuC scheduling queue
4. Deadlock occurs when migrate queue cannot service the original page fault

How to detect it

Review kernel logs for drm/xe scheduler stalls or deadlocks during page-fault handling; correlate with Xe GPU activity and USM migration events.

What your security team should do

• Apply the referenced kernel commit or distribution update within normal patching windows
• Prioritize systems running graphics workloads with USM enabled
• Add kernel oops and hang monitoring for drm/xe to existing alerting