CVE-2024-57844

What it actually does

Missing drm_dev_enter/exit protection allows kernel page fault on hardware access during fd close after device unbind in the xe driver, triggered in xe_lrc_update_timestamp and related exec queue teardown paths.

Why it matters to the business

Kernel crashes and system instability on Linux systems with Intel Xe graphics when applications close file descriptors after unbinding, resulting in denial of service and potential data loss or service disruption.

How an attack unfolds

An attacker with local access holds a graphics device fd open, triggers device unbind, then closes the fd; the driver attempts supervisor read access to unmapped memory during async exec queue finalization, causing a page fault.

How to fix it

Upgrade the Linux kernel to version 6.12.9 or apply commit 924d43bd10a1f6723ac5181a6e6cc2196ba98cdd; rebuild and reboot into the patched kernel.

How to confirm the fix worked

Verify running kernel version is 6.12.9 or newer; inspect drm/xe source for drm_dev_enter calls around xe_file_close and exec queue fini functions; test with IGT xe_wedged workload.

Typical attack path

1. Obtain local user access on affected Linux system
2. Open Xe graphics device file descriptor
3. Perform device unbind operation
4. Close the file descriptor to trigger teardown
5. Observe kernel page fault in xe driver paths

How to detect it

Search kernel logs and dmesg for page fault messages referencing xe_lrc_update_timestamp, xe_exec_queue_fini, xe_file_close, or drm_release after unbind events; correlate with xe_wedged test exits.

• BUG: unable to handle page fault for address
• xe_lrc_update_timestamp+0x1c/0xd0
• xe_exec_queue_fini+0x16/0xb0
• __guc_exec_queue_fini_async
• xe_file_close+0xd4/0x1a0

What your security team should do

• Prioritize kernel upgrade to 6.12.9 on all Xe-equipped systems within maintenance windows
• Enable kernel panic on oops logging and monitor for xe-related page faults
• Restrict unprivileged device unbind operations via policy where feasible