CVE-2026-99005 - Vulnerability Details

- drm/i915/gt: Unmask interrupts only when ACTIVE is true

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/gt: Unmask interrupts only when ACTIVE is true

There is a small race window between intel_rps_boost() reading
a stale ACTIVE state and queuing rps->work, where ACTIVE may be
changed via asynchronous calls triggered by wakeref drop.
This means that rps_work() could be triggered after the GT has
been parked, so unmasking RPS PM interrupts would happen without
holding PM wakelock. This sequence of events may be observed
during live_rc6_ctx_wa() selftest:

1) live_rc6_ctx_wa()
-> intel_engine_pm_put()
-> wakeref_put()

ASYNC1) wakeref_put() callback
-> __engine_park()
-> intel_gt_pm_put_async()
-> intel_gt_pm_put_async_untracked()
-> intel_wakeref_put_async()

ASYNC2) wakeref_put_async() callback
-> __gt_park()
-> intel_rps_park()
-> intel_rps_clear_active() [clear ACTIVE]
WITH INTERRUPTS:
-> rps_disable_interrupts()
-> cancel_work_sync(rps->work)
-> rps_reset_interrupts() [rps->pm_iir = 0]
WITHOUT INTERRUPTS (TIMER mode):
-> rps_stop_timer()
-> cancel_work_sync(rps->work)

2) live_rc6_ctx_wa()
-> intel_gt_wait_for_idle()
-> intel_gt_retire_requests_timeout()
-> dma_fence_wait_timeout()
-> ops->wait() [i915_fence_wait()]
-> i915_request_wait_timeout()
-> intel_rps_boost()
-> intel_rps_is_active() [check ACTIVE]
[OPEN RACE WINDOW]
-> queue_work(rps->work)
-> retire_requests()
-> i915_request_retire()
-> intel_rps_dec_waiters() [from 1 to 0]

If ASYNC1 and ASYNC2 would execute during [OPEN RACE WINDOW],
then:

3) rps_work() executes from the workqueue and may satisfy
"(!pm_iir && !client_boost)" test (in TIMER mode rps->pm_iir
is zeroed by an earlier rps_work() call or never gets a new
value after previous intel_rps_unpark() event), so it jumps
to "out" label, bypassing intel_rps_is_active() guard and
executes gen6_gt_pm_unmask_irq();

4) GT is parked and runtime PM wakelock is dropped, so only
a raw reference in __gt_park() ->
intel_display_power_put_async() remains for 100ms, then the
MMIO write in gen6_gt_pm_unmask_irq() detects missing
wakelock via assert_rpm_wakelock_held() and emits
"RPM wakelock ref not held during HW access" tainting kernel.

Commit 3e7abf814193 ("drm/i915: Extract GT render power state management")
dropped the "if (rps->interrupts_enabled)" guard that
gen6_pm_rps_work() had around this unmask in i915_irq.c.
INTEL_RPS_ACTIVE brackets the same window, since it is set in
intel_rps_unpark() before rps_enable_interrupts() and
rps_start_timer() and cleared in intel_rps_park() before
rps_stop_timer() and rps_disable_interrupts().

Skip unmasking when RPS is no longer active (reaching unmask
operation is independent of INTERRUPT mode). This does not
prevent RPS operation from resuming on the next unpark.
In interrupt mode, intel_rps_unpark() calls
rps_enable_interrupts(), which enables and unmasks the PM
interrupts. In timer mode, it calls rps_start_timer(),
restarting periodic engine-busyness evaluation. The timer
generates software RPS events and queues rps_work() directly,
independently of PM interrupt delivery. Neither mode requires
the late worker to unmask interrupts while the GT is parked

(cherry picked from commit ca4a6deadad15b91ee083afe445fa6bdbfb68206)

Published: 2026-10-23

Score: 4.7 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability arises from a race condition in the Intel i915 DRM driver that allows interrupts to be unmasked while the graphics engine is parked and the power‑management wakelock has been released. This can cause a hardware register write to occur without the required lock, triggering an assertion that taints the kernel and can potentially lead to a crash or degraded system stability.

Affected Systems

Linux kernel implementations that use the Intel i915 graphics driver before the fix in commit 3e7abf814193. Systems running kernel versions older than the patch, regardless of distribution, are susceptible when runtime power management is active for Intel GPUs.

Risk and Exploitability

The flaw exists in kernel‑level code and is not directly exposed to remote attackers; exploitation requires local or privileged access. The EPSS score is <1%, indicating a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 4.7 indicates a moderate severity and the race condition can lead to a kernel panic or continuous tainting, representing a moderate‑severity kernel stability risk. The official solution is to upgrade to a kernel that contains the guard added in commit 3e7abf814193.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`3e7abf8141935ded77abeb622480bf4a14241ece`	affected	< c2c2bab5eeb227c0c45d971c58a5f66661e7bb8a
`3e7abf8141935ded77abeb622480bf4a14241ece`	affected	< 0eb18add8cd84b4d7a6caa71e78cbe5faa912498
`3e7abf8141935ded77abeb622480bf4a14241ece`	affected	< 8833daaa6f2102b4d527711d09cd72741601242a
`3e7abf8141935ded77abeb622480bf4a14241ece`	affected	< 77abc1837c9651c8f43f7f7f336d10093eeb7745
`3e7abf8141935ded77abeb622480bf4a14241ece`	affected	< 60f58da15f8c8e39706c564f9251de3626636dce
`3e7abf8141935ded77abeb622480bf4a14241ece`	affected	< 0b4a0fb98b9ffeac36798bbd369c821605cae70f
`3e7abf8141935ded77abeb622480bf4a14241ece`	affected	< 49d349c42cf5ebaa878d02699c632c9d883d935f
`3e7abf8141935ded77abeb622480bf4a14241ece`	affected	< 5346b1cec6afa4f9b4b49a9f84e3cfef95a3f7bb

Linux

affected

Version	Status	Constraints
`5.5`	affected	—
`0`	unaffected	< 5.5
`5.10.273`	unaffected	≤ 5.10.*
`5.15.224`	unaffected	≤ 5.15.*
`6.1.191`	unaffected	≤ 6.1.*
`6.6.160`	unaffected	≤ 6.6.*
`6.12.113`	unaffected	≤ 6.12.*
`6.18.57`	unaffected	≤ 6.18.*
`7.2.11`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

100%

Version	Status	Scheme	Platform
`[3e7abf8141935ded77abeb622480bf4a14241ece,77abc1837c9651c8f43f7f7f336d10093eeb7745)`	affected	code_commit	—
`[3e7abf8141935ded77abeb622480bf4a14241ece,60f58da15f8c8e39706c564f9251de3626636dce)`	affected	code_commit	—
`[3e7abf8141935ded77abeb622480bf4a14241ece,0b4a0fb98b9ffeac36798bbd369c821605cae70f)`	affected	code_commit	—
`[3e7abf8141935ded77abeb622480bf4a14241ece,49d349c42cf5ebaa878d02699c632c9d883d935f)`	affected	code_commit	—
`[3e7abf8141935ded77abeb622480bf4a14241ece,5346b1cec6afa4f9b4b49a9f84e3cfef95a3f7bb)`	affected	code_commit	—

Linux

100%

Version	Status	Scheme	Platform
`5.5`	affected	generic	—
`[0,5.5)`	unaffected	generic	—
`[0,6.7.0]`	unaffected	semver	—
`[0,6.13.0]`	unaffected	semver	—
`[0,6.19.0]`	unaffected	semver	—
`[0,7.3.0]`	unaffected	semver	—
`[0,*]`	unaffected	generic	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[3e7abf8141935ded77abeb622480bf4a14241ece,77abc1837c9651c8f43f7f7f336d10093eeb7745)`	affected	code_commit	—
`[3e7abf8141935ded77abeb622480bf4a14241ece,60f58da15f8c8e39706c564f9251de3626636dce)`	affected	code_commit	—
`[3e7abf8141935ded77abeb622480bf4a14241ece,0b4a0fb98b9ffeac36798bbd369c821605cae70f)`	affected	code_commit	—
`[3e7abf8141935ded77abeb622480bf4a14241ece,49d349c42cf5ebaa878d02699c632c9d883d935f)`	affected	code_commit	—
`[3e7abf8141935ded77abeb622480bf4a14241ece,5346b1cec6afa4f9b4b49a9f84e3cfef95a3f7bb)`	affected	code_commit	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`5.5`	affected	generic	—
`[0,5.5)`	unaffected	generic	—
`[0,6.7.0]`	unaffected	semver	—
`[0,6.13.0]`	unaffected	semver	—
`[0,6.19.0]`	unaffected	semver	—
`[0,7.3.0]`	unaffected	semver	—
`[0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that incorporates commit 3e7abf814193, which restores the guard that prevents interrupt unmasking when the GPU is parked.
If using a custom or frozen kernel tree, recompile the i915 module with the patch applied to the driver.
After applying the patch, reboot the system and verify that no "RPM wakelock ref not held during HW access" messages appear in dmesg.

Generated by OpenCVE AI on October 29, 2026 at 14:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00194.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99005.mbox
https://git.kernel.org/stable/c/0b4a0fb98b9ffeac36798bbd369c821605cae70f
https://git.kernel.org/stable/c/0eb18add8cd84b4d7a6caa71e78cbe5faa912498
https://git.kernel.org/stable/c/49d349c42cf5ebaa878d02699c632c9d883d935f
https://git.kernel.org/stable/c/5346b1cec6afa4f9b4b49a9f84e3cfef95a3f7bb
https://git.kernel.org/stable/c/60f58da15f8c8e39706c564f9251de3626636dce
https://git.kernel.org/stable/c/77abc1837c9651c8f43f7f7f336d10093eeb7745
https://git.kernel.org/stable/c/8833daaa6f2102b4d527711d09cd72741601242a
https://git.kernel.org/stable/c/c2c2bab5eeb227c0c45d971c58a5f66661e7bb8a
https://nvd.nist.gov/vuln/detail/CVE-2026-99005
https://www.cve.org/CVERecord?id=CVE-2026-99005

History

Fri, 30 Oct 2026 13:00:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/0eb18add8cd84b4d7a6caa71e78cbe5faa912498 https://git.kernel.org/stable/c/8833daaa6f2102b4d527711d09cd72741601242a https://git.kernel.org/stable/c/c2c2bab5eeb227c0c45d971c58a5f66661e7bb8a

Thu, 29 Oct 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-367
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99005.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-99005 https://www.cve.org/CVERecord?id=CVE-2026-99005
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 23 Oct 2026 19:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux linux
Vendors & Products		Linux linux

Fri, 23 Oct 2026 15:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362

Fri, 23 Oct 2026 12:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Unmask interrupts only when ACTIVE is true There is a small race window between intel_rps_boost() reading a stale ACTIVE state and queuing rps->work, where ACTIVE may be changed via asynchronous calls triggered by wakeref drop. This means that rps_work() could be triggered after the GT has been parked, so unmasking RPS PM interrupts would happen without holding PM wakelock. This sequence of events may be observed during live_rc6_ctx_wa() selftest: 1) live_rc6_ctx_wa() -> intel_engine_pm_put() -> wakeref_put() ASYNC1) wakeref_put() callback -> __engine_park() -> intel_gt_pm_put_async() -> intel_gt_pm_put_async_untracked() -> intel_wakeref_put_async() ASYNC2) wakeref_put_async() callback -> __gt_park() -> intel_rps_park() -> intel_rps_clear_active() [clear ACTIVE] WITH INTERRUPTS: -> rps_disable_interrupts() -> cancel_work_sync(rps->work) -> rps_reset_interrupts() [rps->pm_iir = 0] WITHOUT INTERRUPTS (TIMER mode): -> rps_stop_timer() -> cancel_work_sync(rps->work) 2) live_rc6_ctx_wa() -> intel_gt_wait_for_idle() -> intel_gt_retire_requests_timeout() -> dma_fence_wait_timeout() -> ops->wait() [i915_fence_wait()] -> i915_request_wait_timeout() -> intel_rps_boost() -> intel_rps_is_active() [check ACTIVE] [OPEN RACE WINDOW] -> queue_work(rps->work) -> retire_requests() -> i915_request_retire() -> intel_rps_dec_waiters() [from 1 to 0] If ASYNC1 and ASYNC2 would execute during [OPEN RACE WINDOW], then: 3) rps_work() executes from the workqueue and may satisfy "(!pm_iir && !client_boost)" test (in TIMER mode rps->pm_iir is zeroed by an earlier rps_work() call or never gets a new value after previous intel_rps_unpark() event), so it jumps to "out" label, bypassing intel_rps_is_active() guard and executes gen6_gt_pm_unmask_irq(); 4) GT is parked and runtime PM wakelock is dropped, so only a raw reference in __gt_park() -> intel_display_power_put_async() remains for 100ms, then the MMIO write in gen6_gt_pm_unmask_irq() detects missing wakelock via assert_rpm_wakelock_held() and emits "RPM wakelock ref not held during HW access" tainting kernel. Commit 3e7abf814193 ("drm/i915: Extract GT render power state management") dropped the "if (rps->interrupts_enabled)" guard that gen6_pm_rps_work() had around this unmask in i915_irq.c. INTEL_RPS_ACTIVE brackets the same window, since it is set in intel_rps_unpark() before rps_enable_interrupts() and rps_start_timer() and cleared in intel_rps_park() before rps_stop_timer() and rps_disable_interrupts(). Skip unmasking when RPS is no longer active (reaching unmask operation is independent of INTERRUPT mode). This does not prevent RPS operation from resuming on the next unpark. In interrupt mode, intel_rps_unpark() calls rps_enable_interrupts(), which enables and unmasks the PM interrupts. In timer mode, it calls rps_start_timer(), restarting periodic engine-busyness evaluation. The timer generates software RPS events and queues rps_work() directly, independently of PM interrupt delivery. Neither mode requires the late worker to unmask interrupts while the GT is parked (cherry picked from commit ca4a6deadad15b91ee083afe445fa6bdbfb68206)
Title		drm/i915/gt: Unmask interrupts only when ACTIVE is true
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0b4a0fb98b9ffeac36798bbd369c821605cae70f https://git.kernel.org/stable/c/49d349c42cf5ebaa878d02699c632c9d883d935f https://git.kernel.org/stable/c/5346b1cec6afa4f9b4b49a9f84e3cfef95a3f7bb https://git.kernel.org/stable/c/60f58da15f8c8e39706c564f9251de3626636dce https://git.kernel.org/stable/c/77abc1837c9651c8f43f7f7f336d10093eeb7745

Subscriptions

Linux Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-23T12:20:30.462Z

Updated: 2026-10-30T12:40:49.182Z

Reserved: 2026-09-25T10:25:14.385Z

Link: CVE-2026-99005

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-23T13:17:22.893

Modified: 2026-10-30T13:21:35.033

Link: CVE-2026-99005

Redhat

Severity : Moderate

Publid Date: 2026-10-23T00:00:00Z

Links: CVE-2026-99005 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-29T14:45:14Z

Weaknesses

CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE-367
Time-of-check Time-of-use (TOCTOU) Race Condition

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object