CVE-2026-53201 (GCVE-0-2026-53201)

Vulnerability from cvelistv5 – Published: 2026-06-25 08:39 – Updated: 2026-08-05 12:34
VLAI
Title
Revert "drm/xe: Skip exec queue schedule toggle if queue is idle during suspend"
Summary
In the Linux kernel, the following vulnerability has been resolved: Revert "drm/xe: Skip exec queue schedule toggle if queue is idle during suspend" This reverts commit 8533051ce92015e9cc6f75e0d52119b9d91610b6. The idle-skip optimization bypasses GuC suspend, so the GPU may not perform the context switch that flushes TLB entries for invalidated userptr VMAs. In LR/preempt-fence VM mode, this can lead to missed TLB invalidation and page faults during userptr invalidation tests. Restore unconditional schedule toggling on suspend so the context-switch TLB flush is always performed. This optimization will be reintroduced with a fix that does not skip suspend in LR/preempt-fence VM mode. (cherry picked from commit 6a1e7934d9a6cf46aecae00a99c2603d1295e170)
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 8533051ce92015e9cc6f75e0d52119b9d91610b6 , < b69b715f48ac7e802c89ed5924795c5b055da91e (git)
Affected: 8533051ce92015e9cc6f75e0d52119b9d91610b6 , < fa7c84726dc217ce0c183926ef9411636c7a2213 (git)
Create a notification for this product.
Linux Linux Affected: 7.0
Unaffected: 0 , < 7.0 (semver)
Unaffected: 7.0.13 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_exec_queue.h",
            "drivers/gpu/drm/xe/xe_guc_submit.c",
            "drivers/gpu/drm/xe/xe_hw_engine_group.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b69b715f48ac7e802c89ed5924795c5b055da91e",
              "status": "affected",
              "version": "8533051ce92015e9cc6f75e0d52119b9d91610b6",
              "versionType": "git"
            },
            {
              "lessThan": "fa7c84726dc217ce0c183926ef9411636c7a2213",
              "status": "affected",
              "version": "8533051ce92015e9cc6f75e0d52119b9d91610b6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_exec_queue.h",
            "drivers/gpu/drm/xe/xe_guc_submit.c",
            "drivers/gpu/drm/xe/xe_hw_engine_group.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "lessThan": "7.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.13",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"drm/xe: Skip exec queue schedule toggle if queue is idle during suspend\"\n\nThis reverts commit 8533051ce92015e9cc6f75e0d52119b9d91610b6.\n\nThe idle-skip optimization bypasses GuC suspend, so the GPU may not\nperform the context switch that flushes TLB entries for invalidated\nuserptr VMAs. In LR/preempt-fence VM mode, this can lead to missed TLB\ninvalidation and page faults during userptr invalidation tests.\n\nRestore unconditional schedule toggling on suspend so the context-switch\nTLB flush is always performed.\n\nThis optimization will be reintroduced with a fix that does not skip\nsuspend in LR/preempt-fence VM mode.\n\n(cherry picked from commit 6a1e7934d9a6cf46aecae00a99c2603d1295e170)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Reachability is through local DRM Xe render-node IOCTLs such as VM creation, userptr VM_BIND, exec-queue creation, and EXEC submission. The affected path is not exposed over the network or an adjacent/physical protocol.\nAC:L - The attacker can create the required LR/preempt-fence fault-mode VM, non-parallel idle exec queue, userptr mapping, and invalidation sequence themselves. The idle/suspend condition is attacker-controllable and does not require winning an external race.\nPR:L - The IOCTLs are DRM_RENDER_ALLOW and do not require CAP_SYS_ADMIN or another real root capability. Exploitation requires only a local user able to open the Xe DRM render device.\nUI:N - No victim action is required after the attacker has local access to the render node. The attacker can drive queue creation, submission, and userptr invalidation directly.\nS:U - The vulnerability affects the same host kernel/GPU memory-management security authority. There is no demonstrated VM escape, IOMMU bypass across guests, or separate security authority transition.\nC:H - Missed TLB invalidation can leave stale GPU translations to invalidated userptr pages, allowing GPU commands to read physical pages after they are reused. In the highest reasonable scenario this can disclose arbitrary sensitive memory.\nI:H - GPU writes through stale translations can corrupt pages after reuse by another process or the kernel. This is a stale DMA-style memory corruption primitive with high integrity impact.\nA:H - The stale translations can trigger GPU page faults, hangs, resets, or broader memory corruption. Repeated triggering can cause high availability impact to the GPU subsystem and potentially the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:34:05.024Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b69b715f48ac7e802c89ed5924795c5b055da91e"
        },
        {
          "url": "https://git.kernel.org/stable/c/fa7c84726dc217ce0c183926ef9411636c7a2213"
        }
      ],
      "title": "Revert \"drm/xe: Skip exec queue schedule toggle if queue is idle during suspend\"",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53201",
    "datePublished": "2026-06-25T08:39:09.631Z",
    "dateReserved": "2026-06-09T07:44:35.391Z",
    "dateUpdated": "2026-08-05T12:34:05.024Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-53201",
      "date": "2026-08-16",
      "epss": "0.00128",
      "percentile": "0.02842"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-53201\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-06-25T09:16:37.690\",\"lastModified\":\"2026-07-06T12:32:17.800\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nRevert \\\"drm/xe: Skip exec queue schedule toggle if queue is idle during suspend\\\"\\n\\nThis reverts commit 8533051ce92015e9cc6f75e0d52119b9d91610b6.\\n\\nThe idle-skip optimization bypasses GuC suspend, so the GPU may not\\nperform the context switch that flushes TLB entries for invalidated\\nuserptr VMAs. In LR/preempt-fence VM mode, this can lead to missed TLB\\ninvalidation and page faults during userptr invalidation tests.\\n\\nRestore unconditional schedule toggling on suspend so the context-switch\\nTLB flush is always performed.\\n\\nThis optimization will be reintroduced with a fix that does not skip\\nsuspend in LR/preempt-fence VM mode.\\n\\n(cherry picked from commit 6a1e7934d9a6cf46aecae00a99c2603d1295e170)\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/xe/xe_exec_queue.h\",\"drivers/gpu/drm/xe/xe_guc_submit.c\",\"drivers/gpu/drm/xe/xe_hw_engine_group.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"8533051ce92015e9cc6f75e0d52119b9d91610b6\",\"lessThan\":\"b69b715f48ac7e802c89ed5924795c5b055da91e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8533051ce92015e9cc6f75e0d52119b9d91610b6\",\"lessThan\":\"fa7c84726dc217ce0c183926ef9411636c7a2213\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/xe/xe_exec_queue.h\",\"drivers/gpu/drm/xe/xe_guc_submit.c\",\"drivers/gpu/drm/xe/xe_hw_engine_group.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"7.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.13\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.0\",\"versionEndExcluding\":\"7.0.13\",\"matchCriteriaId\":\"A6A85CDC-815A-4808-8C81-4703E7947CC5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B1EF7059-E670-45F4-B422-54C40FA86390\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D38F0BF-A728-4133-A358-D44A2F7EE6D6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"EC732D08-5F7B-46D9-B154-E60C7F4F0A97\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"E5910A9D-F60A-409A-B486-FE66BFEBA9B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"81DFF19E-9CF8-49C6-8C36-1E4038622933\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"B0E8FC71-3952-444C-83E9-718DBBBEC615\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/b69b715f48ac7e802c89ed5924795c5b055da91e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fa7c84726dc217ce0c183926ef9411636c7a2213\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-13T16:42:52+00:00",
      "cve": "CVE-2026-53201",
      "id": "CVE-2026-53201",
      "initial_release_date": "2026-06-25T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Information disclosure or denial of service in drm/xe due to improper TLB invalidation",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53201.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.