Cloudanix VulnDB

CVE-2026-80915

None

CVSS

—

EPSS

0.2%

Published

Sep 9, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A graphics driver bug in Linux could let certain memory operations go wrong and cause computers to freeze or show nothing on screen until the software is updated.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The vulnerability permits DPT allocations to fall back from VRAM to system memory or to use stolen memory regions on systems with media GT, bypassing intended default memory region constraints and enabling uncontrolled memory usage that leads to pipe faults, latency under MC6, and potential exhaustion of stolen memory areas.

Why it matters to the business

Systems using affected Linux kernel graphics drivers may experience black screens, random hangs under load, or degraded performance, disrupting operations on affected hardware and requiring urgent kernel updates to restore stability.

How an attack unfolds

An attacker with local access triggers repeated DPT allocation paths during graphics operations or under memory pressure, forcing the driver to use the vulnerable stolen memory or fallback paths, resulting in system instability or denial of service through observed faults and hangs.

How to fix it

Update the Linux kernel to a version containing the fix that removes VRAM fallback and stolen memory usage for DPT allocations, restricting allocations exclusively to the default memory region.

How to confirm the fix worked

Confirm the kernel commit a196406a3831291598fe8e73245914f7acffdfe0 or equivalent patch is applied, then test DPT allocation under load on media GT hardware to verify absence of faults or hangs.

Typical attack path

  1. Obtain local execution on a Linux system with drm/xe driver
  2. Perform graphics or display operations that allocate DPT structures
  3. Induce memory pressure or MC6 state on media GT to engage stolen memory paths
  4. Trigger fallback or stolen allocation to cause pipe faults or exhaustion
  5. Observe resulting system hang or black screen

How to detect it

Examine kernel logs and dmesg output for pipe fault errors, black screen events, or MC6-related latency warnings on drm/xe systems; correlate with high DPT allocation activity under load.

  • pipe fault
  • black screen
  • stolen memory
  • drm/xe
  • DPT allocation

What your security team should do

  • Prioritize kernel updates on all systems using drm/xe driver within the next patch cycle
  • Monitor for system instability reports on Xe graphics hardware
  • Review graphics driver logs for pipe fault errors as a temporary indicator of exposure

The record

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix DPT allocation paths. Remove the fallback for VRAM to system memory, I tested it and that doesn't work at all, only a black screen with pipe fault errors were observed. On systems with media GT, extra latency is added when accessing stolen memory when the GT is in MC6. Since we additionally aren't counting how much memory is used for stolen and we could in theory fill up the entire stolen area with DPT's, avoid using stolen and only use the default memory region. Using stolen may also result in random system hangs under load. (cherry picked from commit a196406a3831291598fe8e73245914f7acffdfe0)

Affected packages

Ecosystem Package Introduced Fixed