Cloudanix VulnDB

CVE-2026-98391

None

CVSS

—

EPSS

0.2%

Published

Oct 14, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing bug in the Linux graphics driver can make the computer crash or log errors when virtual machines are shut down quickly.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

A race condition in the Xe graphics driver allows the device to autosuspend after a VM's runtime PM reference is dropped asynchronously, leaving stale page-fault workers queued; when the worker later executes it calls gu c_ct_send_locked on a suspended device and triggers an assertion failure in xe_device_assert_mem_access.

Why it matters to the business

Systems using the affected driver may experience unexpected kernel warnings or crashes during VM teardown or rapid workload transitions, leading to reduced availability and potential service disruption on graphics-intensive workloads.

How an attack unfolds

An attacker with local access triggers rapid creation and teardown of VMs or exec queues while page faults remain pending, forcing the page-fault worker to run after the device has suspended and causing the assertion to fire.

How to fix it

Apply the upstream fix (commit fcc2431d2213dc4d04250c4f1ae87d9c3ae0d455) or a later kernel release that holds a runtime PM reference across the entire xe_pagefault_queue_work handler using guard(xe_pm_runtime).

How to confirm the fix worked

Boot the patched kernel, reproduce VM teardown workloads that previously triggered the race, and confirm the assertion warning no longer appears in the kernel log; also verify the guard macro is present in the page-fault worker path.

Typical attack path

  1. Create a VM or exec queue that generates page faults
  2. Initiate asynchronous teardown that drops the runtime PM reference
  3. Allow the device to autosuspend before queued faults are processed
  4. Trigger the page-fault worker to execute on the now-suspended device

How to detect it

Search kernel logs (dmesg, journalctl) for the string 'Assertion `!xe_pm_runtime_suspended(xe)` failed!' or the function name xe_device_assert_mem_access around the time of VM teardown events.

  • Assertion `!xe_pm_runtime_suspended(xe)` failed!
  • xe_device_assert_mem_access+0x11c/0x140 [xe]
  • WARNING at xe_device.c:1267

What your security team should do

  • Prioritize kernel updates containing the referenced commit on all systems running the Xe driver
  • Monitor kernel logs for the xe_device_assert_mem_access warning as an immediate indicator of exposure
  • Test the fix under realistic VM teardown scenarios before broad deployment

The record

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Guard page-fault worker with runtime PM check During VM teardown, the VM's runtime PM reference is dropped asynchronously, allowing the device to autosuspend while stale page faults belonging to the now-dead VM are still queued. When the page-fault worker later tries to ack one of these, it calls into guc_ct_send_locked() on an already-suspended device, tripping:   Assertion `!xe_pm_runtime_suspended(xe)` failed!   WARNING at xe_device.c:1267 xe_device_assert_mem_access+0x11c/0x140 [xe] A live VM/exec queue always holds a PM reference while it has outstanding work, so if the device is suspended at ack time, the owning context is already gone and the fault is stale. Take a runtime PM reference across the entire pagefault queue worker to safely deliver acks for torn-down VMs. v3: - Move PM ref to the generic xe_pagefault_queue_work using guard(xe_pm_runtime)(xe) instead of tracking it in the GuC backend(Matt Brost). v2: - Hold PM ref across the entire batch (begin/end) instead of per-ack. This prevents the device from autosuspending mid-batch, which would leave write_only acks written but the end flush skipped, and skip counter++, desyncing the cadence check.(Himal) - Add a comment explaining stale faults.(Himal) (cherry picked from commit fcc2431d2213dc4d04250c4f1ae87d9c3ae0d455) [Rodrigo: Added xe_device struct for compatibility while cherry-picking]

Affected packages

Ecosystem Package Introduced Fixed