CVE-2024-50144

What it actually does

Double call to fence_fini() on error path after GuC CT send for TLB request causes extra rpm put(), allowing device to enter suspend despite active reference.

Why it matters to the business

Systems may experience unexpected power state transitions that interrupt ongoing workloads and reduce reliability of graphics hardware.

How an attack unfolds

An attacker triggers a failure when sending a GuC CT message for a TLB invalidation request; the resulting error path combined with stack-allocated fence leads to duplicate fini() and unintended rpm put(), potentially enabling power state manipulation.

How to fix it

Update to kernel versions containing commit cfcbc0520d5055825f0647ab922b655688605183; prefer warning on double fini() detection; apply available fixed packages for affected distributions.

How to confirm the fix worked

Confirm kernel build includes the referenced commit; monitor for absence of mysterious suspend splats with active rpm refs; verify single fini() calls via added warning instrumentation.

Typical attack path

1. Trigger TLB request path that sends GuC CT message
2. Force error condition during CT transmission
3. Allow both signaller and caller to invoke fence_fini()
4. Observe extra rpm put() and resulting premature suspend

How to detect it

Inspect kernel logs for rpm put() imbalances or suspend splats around GuC CT and TLB request paths; correlate with fence operations in drm/xe code paths.

What your security team should do

• Prioritize kernel updates on systems using Xe DRM driver
• Review power management logs for unexpected suspend events
• Apply fixes listed for distribution packages where available