Vulnerability feed

Executive summary

A flaw in the Linux kernel's Intel i915 graphics driver can cause the kernel to free memory outside the intended buffer during command submission. The advisory text does not state a severity rating or real-world exploitation, and it describes this as a fix in the stable tree.

Technical summary

The flaw is in the drm/i915 GEM execbuffer code, where eb_relocate_parse_slow() can call kvfree() on entries beyond the original exec array because the cleanup path uses an incremented buffer_count that includes VMAs appended by the command parser, which is a memory safety (out-of-bounds) issue. The advisory does not state the attack vector, required privileges, or exploitation conditions. The fix changes the cleanup to use the original exec object count captured before VMAs are appended. Affected and fixed version numbers are not stated, though the commit is cherry-picked to stable and the Cc line references kernel 5.10+. No workarounds or detection guidance are stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from git.kernel.org/stable/c/152fb5083b9333a…29572f9e0f276a404ba6

Impact if exploited

How it is exploited

Attack vector

Local

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affects

LinuxIntelLinuxLinux kernelIntel i915

Executive summary

The advisory describes a fix in the Linux kernel's Intel i915 graphics driver, in the GT power management code. A race condition could cause the driver to touch hardware while the runtime power wakelock was not held, which the kernel reports and taints itself for. The advisory does not state a severity rating, and the fix is a kernel patch that skips an interrupt unmask when the GPU is no longer active.

Technical summary

The flaw is a race condition in the drm/i915 GT render power management code, where rps_work() could run after the GT was parked and unmask RPS PM interrupts without the runtime PM wakelock held. The advisory describes this as observed during the live_rc6_ctx_wa() selftest, and it does not describe a remote attack vector or required preconditions beyond the timing race. The fix skips the unmask when RPS is no longer active, and it is described as a cherry-picked commit ca4a6deadad15b91ee083afe445fa6bdbfb68206. Affected and fixed kernel version ranges are not stated in the advisory, and no workaround is stated. No detection guidance or CVSS score is stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Score

No CVSS score published.

Affects

LinuxIntelLinuxLinux kernelIntel i915