The issue is a race condition in the Linux kernel’s DRM/xe/vf subsystem that handles virtual function (VF) Container (CCS) read/write batch buffers during buffer object (BO) moves. The attach and detach of CCS buffers are performed immediately after building the copy/clear fence, without synchronizing with the fence signal, allowing the state to be updated too late or too early. An attacker can trigger a VF migration that pauses execution mid‑copy or mid‑blit and observe inconsistent CCS metadata or torn down buffers, leading to incorrect graphics state handling and potential kernel instability.

All Linux kernel releases that contain the original DRM/xe/vf code before the commit that introduces the fix (commit d45ad0aa7a1eb5d7288b5ed948b05695611dc39e). Kernels subsequent to that commit are not affected.

No EPSS or KEV data is available and the CVSS score is not disclosed. The flaw is a classic race condition (CWE‑362) in privileged kernel code. The likely attack vector is a local or privileged user who can initiate VF migrations or otherwise influence buffer moves to coordinate timing with the race. While there are no publicly known exploits, the high potential for kernel state corruption justifies prompt remediation.