In the Linux kernel, the DRM/xe subsystem was missing a wait on the kernel fences of external buffer objects (BOs) in the exec IOCTL path. The code only added the VM’s DMA reservation kernel slot as a dependency, skipping the kernel slots of external BOs that carry their own DMA reservation fences. Because those external BOs may be undergoing kernel operations such as evictions or moves, a user job could start before those operations finish, racing against them and potentially reading or writing memory that the kernel was in the process of relocating. This race violates the DMA reservation contract and can corrupt kernel memory, which may ultimately enable privilege escalation or cause a denial of service. The flaw is a classic example of CWE-367.

All Linux kernel distributions that ship the DRM/xe subsystem before the inclusion of commit a6b842acf3ddd1efc53a56de9260cfa718fb35e7. This includes standard upstream Linux kernels and any derivative kernels that expose /dev/dri devices and allow external buffer objects to be used via the DRM interface.

The flaw is local; an attacker must have access to a DRM device such as /dev/dri/card0 and be able to submit an exec IOCTL that references an external buffer object. The CVSS score of 7.8 indicates a high severity, and the EPSS score of < 1% suggests a low likelihood of exploitation. The vulnerability is not listed in CISA KEV, so the actual exploitation frequency is uncertain. Because the race can corrupt kernel memory, a successful exploitation could lead to privilege escalation or a denial of service. Based on the description, the likely attack vector is local through the DRM interface, requiring the attacker to have write permission to the DRM device.