CVE-2024-46867

What it actually does

Race condition in drm/xe/client show_meminfo() that holds a spinlock while dropping the final reference to a buffer object, causing xe_bo destruction to attempt the same lock and/or sleep in atomic context.

Why it matters to the business

Linux systems using Intel Xe graphics may experience kernel deadlocks or crashes when memory information is queried under load, leading to system instability and potential denial of service for graphics workloads.

How an attack unfolds

A local attacker triggers show_meminfo() while racing with buffer object teardown so that the final put occurs inside the held spinlock, forcing the destruction path to reacquire the lock or sleep, resulting in deadlock.

How to fix it

Upgrade the Linux kernel to commit 9d3de463e23bfb1ff1567a32b099b1b3e5286a48 or later; apply the equivalent stable backports that replace the direct put with xe_bo_put_deferred() and move the final commit outside the lock. Rebuild and reboot.

How to confirm the fix worked

Confirm the running kernel contains commit 9d3de463e23bfb1ff1567a32b099b1b3e5286a48; exercise show_meminfo() under memory pressure and verify absence of deadlock or sleeping-while-atomic warnings in dmesg.

Typical attack path

1. Obtain local shell on affected Linux kernel with Xe graphics
2. Invoke or race memory-info display paths that call show_meminfo()
3. Trigger concurrent buffer object release to hit the final reference drop inside the spinlock
4. Cause kernel deadlock or sleeping-while-atomic panic

How to detect it

Review dmesg and kernel logs for sleeping-while-atomic or deadlock warnings involving xe_bo or show_meminfo; correlate with processes that query DRM client memory statistics.

What your security team should do

• Prioritize kernel upgrade on all Xe-equipped systems within normal patch windows
• Monitor vendor advisories for distribution-specific backports
• Add kernel deadlock and sleeping-while-atomic warnings to SIEM alerts
• Test graphics workloads after patching to confirm stability