The kernel function emit_render_cache_flush() incorrectly omitted a request to flush the LSC untyped L1 dataport cache on newer Intel Xe2 and later GPUs. As a result, memory that has been released or evicted could still contain stale data in the L1 cache, which may be reused by another allocation. The consequence is that future userspace processes—including Vulkan applications such as Llama.cpp—may read incorrect or corrupted data, leading to crashes, incorrect results, or potential leakage of sensitive information. The flaw does not provide immediate privilege escalation, but it undermines data integrity and confidentiality in graphics workloads.

Linux kernel builds running on Intel Xe2 and newer graphics hardware (e.g., BMG, MTL). The issue is present in kernels prior to the patch that added an explicit UNFLIPPED_DATAPORT_CACHE_FLUSH bit in PIPE_CONTROL alongside HDC_PIPELINE_FLUSH. No specific kernel versions are listed, so any distribution using a kernel without the patch on a Xe2+ device is potentially affected.

The flaw relies on a missing hardware cache flush that must be triggered by kernel code. An attacker would need to cause memory to be released within the graphics subsystem and then read L1 cache contents, which typically requires elevated privileges or a user‑level vector that can influence the workload execution order. The EPSS score is unavailable and the vulnerability is not in CISA's KEV list, suggesting low to moderate exploit likelihood. The CVSS score is not reported, but the impact is limited to data corruption or leakage rather than arbitrary code execution.