CVE-2024-44956

What it actually does

The flaw is a race condition in drm/xe/preempt_fence where preempt_fence_work_func operates outside the full fence critical section on a single global ordered workqueue, allowing callbacks to block while holding locks such as vm->lock and preventing other published fences from signaling.

Why it matters to the business

Systems using the affected Linux kernel Xe graphics driver may experience deadlocks leading to graphics subsystem hangs or full system unresponsiveness, disrupting operations on servers or workstations with modern Intel GPUs; low exploitability reduces immediate ransomware or targeted attack risk.

How an attack unfolds

An attacker with local code execution triggers preempt fence operations in a sequence that causes the workqueue callback to contend on vm->lock outside the critical section, stalling fence signaling and inducing deadlock; no named threat actors or ransomware campaigns are associated.

How to fix it

Upgrade the Linux kernel to commit 458bb83119dfee5d14c677f7846dd9363817006f or a later stable release containing the enlarged fence critical section; for the secondary affected package update github.com/flyteorg/flyteadmin to version 1.1.124 or newer.

How to confirm the fix worked

Confirm the running kernel contains commit 458bb83119dfee5d14c677f7846dd9363817006f via git log or package version; exercise graphics workloads that previously triggered preempt fences and verify absence of deadlock warnings from lockdep.

Typical attack path

1. Obtain local user or container access on an affected Linux system
2. Exercise Xe driver paths that publish and signal preempt fences
3. Force lock contention on vm->lock during fence callback execution
4. Block the ordered workqueue and prevent subsequent fence completions

How to detect it

Review kernel logs for drm/xe preempt fence workqueue stalls or lockdep warnings involving vm->lock; correlate with process activity that exercises Intel Xe graphics submission paths.

What your security team should do

• Apply the referenced kernel commit or distribution update within standard patch cycles given low EPSS and absence from KEV
• Monitor internal systems for Xe driver deadlocks during graphics-intensive workloads
• Review downstream package dependencies for the flyteadmin component and schedule its upgrade