Vulnerability-Lookup

CVE-2026-99005 (GCVE-0-2026-99005)

Vulnerability from cvelistv5 – Published: 2026-10-23 12:20 – Updated: 2026-10-23 12:20

Title

drm/i915/gt: Unmask interrupts only when ACTIVE is true

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Unmask interrupts only when ACTIVE is true There is a small race window between intel_rps_boost() reading a stale ACTIVE state and queuing rps->work, where ACTIVE may be changed via asynchronous calls triggered by wakeref drop. This means that rps_work() could be triggered after the GT has been parked, so unmasking RPS PM interrupts would happen without holding PM wakelock. This sequence of events may be observed during live_rc6_ctx_wa() selftest: 1) live_rc6_ctx_wa() -> intel_engine_pm_put() -> wakeref_put() ASYNC1) wakeref_put() callback -> __engine_park() -> intel_gt_pm_put_async() -> intel_gt_pm_put_async_untracked() -> intel_wakeref_put_async() ASYNC2) wakeref_put_async() callback -> __gt_park() -> intel_rps_park() -> intel_rps_clear_active() [clear ACTIVE] WITH INTERRUPTS: -> rps_disable_interrupts() -> cancel_work_sync(rps->work) -> rps_reset_interrupts() [rps->pm_iir = 0] WITHOUT INTERRUPTS (TIMER mode): -> rps_stop_timer() -> cancel_work_sync(rps->work) 2) live_rc6_ctx_wa() -> intel_gt_wait_for_idle() -> intel_gt_retire_requests_timeout() -> dma_fence_wait_timeout() -> ops->wait() [i915_fence_wait()] -> i915_request_wait_timeout() -> intel_rps_boost() -> intel_rps_is_active() [check ACTIVE] [OPEN RACE WINDOW] -> queue_work(rps->work) -> retire_requests() -> i915_request_retire() -> intel_rps_dec_waiters() [from 1 to 0] If ASYNC1 and ASYNC2 would execute during [OPEN RACE WINDOW], then: 3) rps_work() executes from the workqueue and may satisfy "(!pm_iir && !client_boost)" test (in TIMER mode rps->pm_iir is zeroed by an earlier rps_work() call or never gets a new value after previous intel_rps_unpark() event), so it jumps to "out" label, bypassing intel_rps_is_active() guard and executes gen6_gt_pm_unmask_irq(); 4) GT is parked and runtime PM wakelock is dropped, so only a raw reference in __gt_park() -> intel_display_power_put_async() remains for 100ms, then the MMIO write in gen6_gt_pm_unmask_irq() detects missing wakelock via assert_rpm_wakelock_held() and emits "RPM wakelock ref not held during HW access" tainting kernel. Commit 3e7abf814193 ("drm/i915: Extract GT render power state management") dropped the "if (rps->interrupts_enabled)" guard that gen6_pm_rps_work() had around this unmask in i915_irq.c. INTEL_RPS_ACTIVE brackets the same window, since it is set in intel_rps_unpark() before rps_enable_interrupts() and rps_start_timer() and cleared in intel_rps_park() before rps_stop_timer() and rps_disable_interrupts(). Skip unmasking when RPS is no longer active (reaching unmask operation is independent of INTERRUPT mode). This does not prevent RPS operation from resuming on the next unpark. In interrupt mode, intel_rps_unpark() calls rps_enable_interrupts(), which enables and unmasks the PM interrupts. In timer mode, it calls rps_start_timer(), restarting periodic engine-busyness evaluation. The timer generates software RPS events and queues rps_work() directly, independently of PM interrupt delivery. Neither mode requires the late worker to unmask interrupts while the GT is parked (cherry picked from commit ca4a6deadad15b91ee083afe445fa6bdbfb68206)

Severity

No CVSS data available.

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 7056 records in the last 180 days details

References

5 references

URL	Tags
https://git.kernel.org/stable/c/77abc1837c9651c8f…
https://git.kernel.org/stable/c/60f58da15f8c8e397…
https://git.kernel.org/stable/c/0b4a0fb98b9ffeac3…
https://git.kernel.org/stable/c/49d349c42cf5ebaa8…
https://git.kernel.org/stable/c/5346b1cec6afa4f9b…

Impacted products

2 products

Vendor	Product	Version	CPE status
Linux	Linux	Affected: 3e7abf8141935ded77abeb622480bf4a14241ece , < 77abc1837c9651c8f43f7f7f336d10093eeb7745 (git) Affected: 3e7abf8141935ded77abeb622480bf4a14241ece , < 60f58da15f8c8e39706c564f9251de3626636dce (git) Affected: 3e7abf8141935ded77abeb622480bf4a14241ece , < 0b4a0fb98b9ffeac36798bbd369c821605cae70f (git) Affected: 3e7abf8141935ded77abeb622480bf4a14241ece , < 49d349c42cf5ebaa878d02699c632c9d883d935f (git) Affected: 3e7abf8141935ded77abeb622480bf4a14241ece , < 5346b1cec6afa4f9b4b49a9f84e3cfef95a3f7bb (git)	guessed
Linux	Linux	Affected: 5.5 Unaffected: 0 , < 5.5 (semver) Unaffected: 6.6.160 , ≤ 6.6.* (semver) Unaffected: 6.12.113 , ≤ 6.12.* (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/i915/gt/intel_rps.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "77abc1837c9651c8f43f7f7f336d10093eeb7745",
              "status": "affected",
              "version": "3e7abf8141935ded77abeb622480bf4a14241ece",
              "versionType": "git"
            },
            {
              "lessThan": "60f58da15f8c8e39706c564f9251de3626636dce",
              "status": "affected",
              "version": "3e7abf8141935ded77abeb622480bf4a14241ece",
              "versionType": "git"
            },
            {
              "lessThan": "0b4a0fb98b9ffeac36798bbd369c821605cae70f",
              "status": "affected",
              "version": "3e7abf8141935ded77abeb622480bf4a14241ece",
              "versionType": "git"
            },
            {
              "lessThan": "49d349c42cf5ebaa878d02699c632c9d883d935f",
              "status": "affected",
              "version": "3e7abf8141935ded77abeb622480bf4a14241ece",
              "versionType": "git"
            },
            {
              "lessThan": "5346b1cec6afa4f9b4b49a9f84e3cfef95a3f7bb",
              "status": "affected",
              "version": "3e7abf8141935ded77abeb622480bf4a14241ece",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/i915/gt/intel_rps.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.5"
            },
            {
              "lessThan": "5.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.57",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.113",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.57",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.11",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gt: Unmask interrupts only when ACTIVE is true\n\nThere is a small race window between intel_rps_boost() reading\na stale ACTIVE state and queuing rps-\u003ework, where ACTIVE may be\nchanged via asynchronous calls triggered by wakeref drop.\nThis means that rps_work() could be triggered after the GT has\nbeen parked, so unmasking RPS PM interrupts would happen without\nholding PM wakelock. This sequence of events may be observed\nduring live_rc6_ctx_wa() selftest:\n\n1) live_rc6_ctx_wa()\n   -\u003e intel_engine_pm_put()\n      -\u003e wakeref_put()\n\nASYNC1) wakeref_put() callback\n          -\u003e __engine_park()\n             -\u003e intel_gt_pm_put_async()\n                -\u003e intel_gt_pm_put_async_untracked()\n                   -\u003e intel_wakeref_put_async()\n\nASYNC2) wakeref_put_async() callback\n          -\u003e __gt_park()\n             -\u003e intel_rps_park()\n                -\u003e intel_rps_clear_active() [clear ACTIVE]\n                WITH INTERRUPTS:\n                -\u003e rps_disable_interrupts()\n                   -\u003e cancel_work_sync(rps-\u003ework)\n                   -\u003e rps_reset_interrupts() [rps-\u003epm_iir = 0]\n                WITHOUT INTERRUPTS (TIMER mode):\n                -\u003e rps_stop_timer()\n                   -\u003e cancel_work_sync(rps-\u003ework)\n\n2) live_rc6_ctx_wa()\n   -\u003e intel_gt_wait_for_idle()\n      -\u003e intel_gt_retire_requests_timeout()\n         -\u003e dma_fence_wait_timeout()\n            -\u003e ops-\u003ewait() [i915_fence_wait()]\n               -\u003e i915_request_wait_timeout()\n                  -\u003e intel_rps_boost()\n                     -\u003e intel_rps_is_active() [check ACTIVE]\n                        [OPEN RACE WINDOW]\n                     -\u003e queue_work(rps-\u003ework)\n         -\u003e retire_requests()\n            -\u003e i915_request_retire()\n               -\u003e intel_rps_dec_waiters() [from 1 to 0]\n\nIf ASYNC1 and ASYNC2 would execute during [OPEN RACE WINDOW],\nthen:\n\n3) rps_work() executes from the workqueue and may satisfy\n   \"(!pm_iir \u0026\u0026 !client_boost)\" test (in TIMER mode rps-\u003epm_iir\n   is zeroed by an earlier rps_work() call or never gets a new\n   value after previous intel_rps_unpark() event), so it jumps\n   to \"out\" label, bypassing intel_rps_is_active() guard and\n   executes gen6_gt_pm_unmask_irq();\n\n4) GT is parked and runtime PM wakelock is dropped, so only\n   a raw reference in __gt_park() -\u003e\n   intel_display_power_put_async() remains for 100ms, then the\n   MMIO write in gen6_gt_pm_unmask_irq() detects missing\n   wakelock via assert_rpm_wakelock_held() and emits\n   \"RPM wakelock ref not held during HW access\" tainting kernel.\n\nCommit 3e7abf814193 (\"drm/i915: Extract GT render power state management\")\ndropped the \"if (rps-\u003einterrupts_enabled)\" guard that\ngen6_pm_rps_work() had around this unmask in i915_irq.c.\nINTEL_RPS_ACTIVE brackets the same window, since it is set in\nintel_rps_unpark() before rps_enable_interrupts() and\nrps_start_timer() and cleared in intel_rps_park() before\nrps_stop_timer() and rps_disable_interrupts().\n\nSkip unmasking when RPS is no longer active (reaching unmask\noperation is independent of INTERRUPT mode). This does not\nprevent RPS operation from resuming on the next unpark.\nIn interrupt mode, intel_rps_unpark() calls\nrps_enable_interrupts(), which enables and unmasks the PM\ninterrupts. In timer mode, it calls rps_start_timer(),\nrestarting periodic engine-busyness evaluation. The timer\ngenerates software RPS events and queues rps_work() directly,\nindependently of PM interrupt delivery. Neither mode requires\nthe late worker to unmask interrupts while the GT is parked\n\n(cherry picked from commit ca4a6deadad15b91ee083afe445fa6bdbfb68206)"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-23T12:20:30.462Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/77abc1837c9651c8f43f7f7f336d10093eeb7745"
        },
        {
          "url": "https://git.kernel.org/stable/c/60f58da15f8c8e39706c564f9251de3626636dce"
        },
        {
          "url": "https://git.kernel.org/stable/c/0b4a0fb98b9ffeac36798bbd369c821605cae70f"
        },
        {
          "url": "https://git.kernel.org/stable/c/49d349c42cf5ebaa878d02699c632c9d883d935f"
        },
        {
          "url": "https://git.kernel.org/stable/c/5346b1cec6afa4f9b4b49a9f84e3cfef95a3f7bb"
        }
      ],
      "title": "drm/i915/gt: Unmask interrupts only when ACTIVE is true",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-99005",
    "datePublished": "2026-10-23T12:20:30.462Z",
    "dateReserved": "2026-09-25T10:25:14.385Z",
    "dateUpdated": "2026-10-23T12:20:30.462Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-99005",
      "date": "2026-10-24",
      "epss": "0.00219",
      "percentile": "0.11784"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/i915/gt/intel_rps.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "77abc1837c9651c8f43f7f7f336d10093eeb7745",
                    "status": "affected",
                    "version": "3e7abf8141935ded77abeb622480bf4a14241ece",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "60f58da15f8c8e39706c564f9251de3626636dce",
                    "status": "affected",
                    "version": "3e7abf8141935ded77abeb622480bf4a14241ece",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0b4a0fb98b9ffeac36798bbd369c821605cae70f",
                    "status": "affected",
                    "version": "3e7abf8141935ded77abeb622480bf4a14241ece",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "49d349c42cf5ebaa878d02699c632c9d883d935f",
                    "status": "affected",
                    "version": "3e7abf8141935ded77abeb622480bf4a14241ece",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5346b1cec6afa4f9b4b49a9f84e3cfef95a3f7bb",
                    "status": "affected",
                    "version": "3e7abf8141935ded77abeb622480bf4a14241ece",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/i915/gt/intel_rps.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.5"
                  },
                  {
                    "lessThan": "5.5",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.160",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.113",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.57",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.11",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gt: Unmask interrupts only when ACTIVE is true\n\nThere is a small race window between intel_rps_boost() reading\na stale ACTIVE state and queuing rps-\u003ework, where ACTIVE may be\nchanged via asynchronous calls triggered by wakeref drop.\nThis means that rps_work() could be triggered after the GT has\nbeen parked, so unmasking RPS PM interrupts would happen without\nholding PM wakelock. This sequence of events may be observed\nduring live_rc6_ctx_wa() selftest:\n\n1) live_rc6_ctx_wa()\n   -\u003e intel_engine_pm_put()\n      -\u003e wakeref_put()\n\nASYNC1) wakeref_put() callback\n          -\u003e __engine_park()\n             -\u003e intel_gt_pm_put_async()\n                -\u003e intel_gt_pm_put_async_untracked()\n                   -\u003e intel_wakeref_put_async()\n\nASYNC2) wakeref_put_async() callback\n          -\u003e __gt_park()\n             -\u003e intel_rps_park()\n                -\u003e intel_rps_clear_active() [clear ACTIVE]\n                WITH INTERRUPTS:\n                -\u003e rps_disable_interrupts()\n                   -\u003e cancel_work_sync(rps-\u003ework)\n                   -\u003e rps_reset_interrupts() [rps-\u003epm_iir = 0]\n                WITHOUT INTERRUPTS (TIMER mode):\n                -\u003e rps_stop_timer()\n                   -\u003e cancel_work_sync(rps-\u003ework)\n\n2) live_rc6_ctx_wa()\n   -\u003e intel_gt_wait_for_idle()\n      -\u003e intel_gt_retire_requests_timeout()\n         -\u003e dma_fence_wait_timeout()\n            -\u003e ops-\u003ewait() [i915_fence_wait()]\n               -\u003e i915_request_wait_timeout()\n                  -\u003e intel_rps_boost()\n                     -\u003e intel_rps_is_active() [check ACTIVE]\n                        [OPEN RACE WINDOW]\n                     -\u003e queue_work(rps-\u003ework)\n         -\u003e retire_requests()\n            -\u003e i915_request_retire()\n               -\u003e intel_rps_dec_waiters() [from 1 to 0]\n\nIf ASYNC1 and ASYNC2 would execute during [OPEN RACE WINDOW],\nthen:\n\n3) rps_work() executes from the workqueue and may satisfy\n   \"(!pm_iir \u0026\u0026 !client_boost)\" test (in TIMER mode rps-\u003epm_iir\n   is zeroed by an earlier rps_work() call or never gets a new\n   value after previous intel_rps_unpark() event), so it jumps\n   to \"out\" label, bypassing intel_rps_is_active() guard and\n   executes gen6_gt_pm_unmask_irq();\n\n4) GT is parked and runtime PM wakelock is dropped, so only\n   a raw reference in __gt_park() -\u003e\n   intel_display_power_put_async() remains for 100ms, then the\n   MMIO write in gen6_gt_pm_unmask_irq() detects missing\n   wakelock via assert_rpm_wakelock_held() and emits\n   \"RPM wakelock ref not held during HW access\" tainting kernel.\n\nCommit 3e7abf814193 (\"drm/i915: Extract GT render power state management\")\ndropped the \"if (rps-\u003einterrupts_enabled)\" guard that\ngen6_pm_rps_work() had around this unmask in i915_irq.c.\nINTEL_RPS_ACTIVE brackets the same window, since it is set in\nintel_rps_unpark() before rps_enable_interrupts() and\nrps_start_timer() and cleared in intel_rps_park() before\nrps_stop_timer() and rps_disable_interrupts().\n\nSkip unmasking when RPS is no longer active (reaching unmask\noperation is independent of INTERRUPT mode). This does not\nprevent RPS operation from resuming on the next unpark.\nIn interrupt mode, intel_rps_unpark() calls\nrps_enable_interrupts(), which enables and unmasks the PM\ninterrupts. In timer mode, it calls rps_start_timer(),\nrestarting periodic engine-busyness evaluation. The timer\ngenerates software RPS events and queues rps_work() directly,\nindependently of PM interrupt delivery. Neither mode requires\nthe late worker to unmask interrupts while the GT is parked\n\n(cherry picked from commit ca4a6deadad15b91ee083afe445fa6bdbfb68206)"
          }
        ],
        "id": "CVE-2026-99005",
        "lastModified": "2026-10-23T13:17:22.893",
        "metrics": {},
        "published": "2026-10-23T13:17:22.893",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0b4a0fb98b9ffeac36798bbd369c821605cae70f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/49d349c42cf5ebaa878d02699c632c9d883d935f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5346b1cec6afa4f9b4b49a9f84e3cfef95a3f7bb"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/60f58da15f8c8e39706c564f9251de3626636dce"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/77abc1837c9651c8f43f7f7f336d10093eeb7745"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}

FKIE_CVE-2026-99005

Vulnerability from fkie_nvd - Published: 2026-10-23 13:17 - Updated: 2026-10-23 13:17

Severity

Summary

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/0b4a0fb98b9ffeac36798bbd369c821605cae70f
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/49d349c42cf5ebaa878d02699c632c9d883d935f
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/5346b1cec6afa4f9b4b49a9f84e3cfef95a3f7bb
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/60f58da15f8c8e39706c564f9251de3626636dce
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/77abc1837c9651c8f43f7f7f336d10093eeb7745

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/i915/gt/intel_rps.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "77abc1837c9651c8f43f7f7f336d10093eeb7745",
              "status": "affected",
              "version": "3e7abf8141935ded77abeb622480bf4a14241ece",
              "versionType": "git"
            },
            {
              "lessThan": "60f58da15f8c8e39706c564f9251de3626636dce",
              "status": "affected",
              "version": "3e7abf8141935ded77abeb622480bf4a14241ece",
              "versionType": "git"
            },
            {
              "lessThan": "0b4a0fb98b9ffeac36798bbd369c821605cae70f",
              "status": "affected",
              "version": "3e7abf8141935ded77abeb622480bf4a14241ece",
              "versionType": "git"
            },
            {
              "lessThan": "49d349c42cf5ebaa878d02699c632c9d883d935f",
              "status": "affected",
              "version": "3e7abf8141935ded77abeb622480bf4a14241ece",
              "versionType": "git"
            },
            {
              "lessThan": "5346b1cec6afa4f9b4b49a9f84e3cfef95a3f7bb",
              "status": "affected",
              "version": "3e7abf8141935ded77abeb622480bf4a14241ece",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/i915/gt/intel_rps.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.5"
            },
            {
              "lessThan": "5.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.57",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gt: Unmask interrupts only when ACTIVE is true\n\nThere is a small race window between intel_rps_boost() reading\na stale ACTIVE state and queuing rps-\u003ework, where ACTIVE may be\nchanged via asynchronous calls triggered by wakeref drop.\nThis means that rps_work() could be triggered after the GT has\nbeen parked, so unmasking RPS PM interrupts would happen without\nholding PM wakelock. This sequence of events may be observed\nduring live_rc6_ctx_wa() selftest:\n\n1) live_rc6_ctx_wa()\n   -\u003e intel_engine_pm_put()\n      -\u003e wakeref_put()\n\nASYNC1) wakeref_put() callback\n          -\u003e __engine_park()\n             -\u003e intel_gt_pm_put_async()\n                -\u003e intel_gt_pm_put_async_untracked()\n                   -\u003e intel_wakeref_put_async()\n\nASYNC2) wakeref_put_async() callback\n          -\u003e __gt_park()\n             -\u003e intel_rps_park()\n                -\u003e intel_rps_clear_active() [clear ACTIVE]\n                WITH INTERRUPTS:\n                -\u003e rps_disable_interrupts()\n                   -\u003e cancel_work_sync(rps-\u003ework)\n                   -\u003e rps_reset_interrupts() [rps-\u003epm_iir = 0]\n                WITHOUT INTERRUPTS (TIMER mode):\n                -\u003e rps_stop_timer()\n                   -\u003e cancel_work_sync(rps-\u003ework)\n\n2) live_rc6_ctx_wa()\n   -\u003e intel_gt_wait_for_idle()\n      -\u003e intel_gt_retire_requests_timeout()\n         -\u003e dma_fence_wait_timeout()\n            -\u003e ops-\u003ewait() [i915_fence_wait()]\n               -\u003e i915_request_wait_timeout()\n                  -\u003e intel_rps_boost()\n                     -\u003e intel_rps_is_active() [check ACTIVE]\n                        [OPEN RACE WINDOW]\n                     -\u003e queue_work(rps-\u003ework)\n         -\u003e retire_requests()\n            -\u003e i915_request_retire()\n               -\u003e intel_rps_dec_waiters() [from 1 to 0]\n\nIf ASYNC1 and ASYNC2 would execute during [OPEN RACE WINDOW],\nthen:\n\n3) rps_work() executes from the workqueue and may satisfy\n   \"(!pm_iir \u0026\u0026 !client_boost)\" test (in TIMER mode rps-\u003epm_iir\n   is zeroed by an earlier rps_work() call or never gets a new\n   value after previous intel_rps_unpark() event), so it jumps\n   to \"out\" label, bypassing intel_rps_is_active() guard and\n   executes gen6_gt_pm_unmask_irq();\n\n4) GT is parked and runtime PM wakelock is dropped, so only\n   a raw reference in __gt_park() -\u003e\n   intel_display_power_put_async() remains for 100ms, then the\n   MMIO write in gen6_gt_pm_unmask_irq() detects missing\n   wakelock via assert_rpm_wakelock_held() and emits\n   \"RPM wakelock ref not held during HW access\" tainting kernel.\n\nCommit 3e7abf814193 (\"drm/i915: Extract GT render power state management\")\ndropped the \"if (rps-\u003einterrupts_enabled)\" guard that\ngen6_pm_rps_work() had around this unmask in i915_irq.c.\nINTEL_RPS_ACTIVE brackets the same window, since it is set in\nintel_rps_unpark() before rps_enable_interrupts() and\nrps_start_timer() and cleared in intel_rps_park() before\nrps_stop_timer() and rps_disable_interrupts().\n\nSkip unmasking when RPS is no longer active (reaching unmask\noperation is independent of INTERRUPT mode). This does not\nprevent RPS operation from resuming on the next unpark.\nIn interrupt mode, intel_rps_unpark() calls\nrps_enable_interrupts(), which enables and unmasks the PM\ninterrupts. In timer mode, it calls rps_start_timer(),\nrestarting periodic engine-busyness evaluation. The timer\ngenerates software RPS events and queues rps_work() directly,\nindependently of PM interrupt delivery. Neither mode requires\nthe late worker to unmask interrupts while the GT is parked\n\n(cherry picked from commit ca4a6deadad15b91ee083afe445fa6bdbfb68206)"
    }
  ],
  "id": "CVE-2026-99005",
  "lastModified": "2026-10-23T13:17:22.893",
  "metrics": {},
  "published": "2026-10-23T13:17:22.893",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/0b4a0fb98b9ffeac36798bbd369c821605cae70f"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/49d349c42cf5ebaa878d02699c632c9d883d935f"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/5346b1cec6afa4f9b4b49a9f84e3cfef95a3f7bb"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/60f58da15f8c8e39706c564f9251de3626636dce"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/77abc1837c9651c8f43f7f7f336d10093eeb7745"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

GHSA-VCPF-23W8-Q6WV

Vulnerability from github – Published: 2026-10-23 15:31 – Updated: 2026-10-23 15:31

Details

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/gt: Unmask interrupts only when ACTIVE is true

There is a small race window between intel_rps_boost() reading a stale ACTIVE state and queuing rps->work, where ACTIVE may be changed via asynchronous calls triggered by wakeref drop. This means that rps_work() could be triggered after the GT has been parked, so unmasking RPS PM interrupts would happen without holding PM wakelock. This sequence of events may be observed during live_rc6_ctx_wa() selftest:

1) live_rc6_ctx_wa() -> intel_engine_pm_put() -> wakeref_put()

ASYNC1) wakeref_put() callback -> __engine_park() -> intel_gt_pm_put_async() -> intel_gt_pm_put_async_untracked() -> intel_wakeref_put_async()

ASYNC2) wakeref_put_async() callback -> __gt_park() -> intel_rps_park() -> intel_rps_clear_active() [clear ACTIVE] WITH INTERRUPTS: -> rps_disable_interrupts() -> cancel_work_sync(rps->work) -> rps_reset_interrupts() [rps->pm_iir = 0] WITHOUT INTERRUPTS (TIMER mode): -> rps_stop_timer() -> cancel_work_sync(rps->work)

2) live_rc6_ctx_wa() -> intel_gt_wait_for_idle() -> intel_gt_retire_requests_timeout() -> dma_fence_wait_timeout() -> ops->wait() [i915_fence_wait()] -> i915_request_wait_timeout() -> intel_rps_boost() -> intel_rps_is_active() [check ACTIVE] [OPEN RACE WINDOW] -> queue_work(rps->work) -> retire_requests() -> i915_request_retire() -> intel_rps_dec_waiters() [from 1 to 0]

If ASYNC1 and ASYNC2 would execute during [OPEN RACE WINDOW], then:

3) rps_work() executes from the workqueue and may satisfy "(!pm_iir && !client_boost)" test (in TIMER mode rps->pm_iir is zeroed by an earlier rps_work() call or never gets a new value after previous intel_rps_unpark() event), so it jumps to "out" label, bypassing intel_rps_is_active() guard and executes gen6_gt_pm_unmask_irq();

4) GT is parked and runtime PM wakelock is dropped, so only a raw reference in __gt_park() -> intel_display_power_put_async() remains for 100ms, then the MMIO write in gen6_gt_pm_unmask_irq() detects missing wakelock via assert_rpm_wakelock_held() and emits "RPM wakelock ref not held during HW access" tainting kernel.

Commit 3e7abf814193 ("drm/i915: Extract GT render power state management") dropped the "if (rps->interrupts_enabled)" guard that gen6_pm_rps_work() had around this unmask in i915_irq.c. INTEL_RPS_ACTIVE brackets the same window, since it is set in intel_rps_unpark() before rps_enable_interrupts() and rps_start_timer() and cleared in intel_rps_park() before rps_stop_timer() and rps_disable_interrupts().

Skip unmasking when RPS is no longer active (reaching unmask operation is independent of INTERRUPT mode). This does not prevent RPS operation from resuming on the next unpark. In interrupt mode, intel_rps_unpark() calls rps_enable_interrupts(), which enables and unmasks the PM interrupts. In timer mode, it calls rps_start_timer(), restarting periodic engine-busyness evaluation. The timer generates software RPS events and queues rps_work() directly, independently of PM interrupt delivery. Neither mode requires the late worker to unmask interrupts while the GT is parked

(cherry picked from commit ca4a6deadad15b91ee083afe445fa6bdbfb68206)

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-99005"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-23T13:17:22Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gt: Unmask interrupts only when ACTIVE is true\n\nThere is a small race window between intel_rps_boost() reading\na stale ACTIVE state and queuing rps-\u003ework, where ACTIVE may be\nchanged via asynchronous calls triggered by wakeref drop.\nThis means that rps_work() could be triggered after the GT has\nbeen parked, so unmasking RPS PM interrupts would happen without\nholding PM wakelock. This sequence of events may be observed\nduring live_rc6_ctx_wa() selftest:\n\n1) live_rc6_ctx_wa()\n   -\u003e intel_engine_pm_put()\n      -\u003e wakeref_put()\n\nASYNC1) wakeref_put() callback\n          -\u003e __engine_park()\n             -\u003e intel_gt_pm_put_async()\n                -\u003e intel_gt_pm_put_async_untracked()\n                   -\u003e intel_wakeref_put_async()\n\nASYNC2) wakeref_put_async() callback\n          -\u003e __gt_park()\n             -\u003e intel_rps_park()\n                -\u003e intel_rps_clear_active() [clear ACTIVE]\n                WITH INTERRUPTS:\n                -\u003e rps_disable_interrupts()\n                   -\u003e cancel_work_sync(rps-\u003ework)\n                   -\u003e rps_reset_interrupts() [rps-\u003epm_iir = 0]\n                WITHOUT INTERRUPTS (TIMER mode):\n                -\u003e rps_stop_timer()\n                   -\u003e cancel_work_sync(rps-\u003ework)\n\n2) live_rc6_ctx_wa()\n   -\u003e intel_gt_wait_for_idle()\n      -\u003e intel_gt_retire_requests_timeout()\n         -\u003e dma_fence_wait_timeout()\n            -\u003e ops-\u003ewait() [i915_fence_wait()]\n               -\u003e i915_request_wait_timeout()\n                  -\u003e intel_rps_boost()\n                     -\u003e intel_rps_is_active() [check ACTIVE]\n                        [OPEN RACE WINDOW]\n                     -\u003e queue_work(rps-\u003ework)\n         -\u003e retire_requests()\n            -\u003e i915_request_retire()\n               -\u003e intel_rps_dec_waiters() [from 1 to 0]\n\nIf ASYNC1 and ASYNC2 would execute during [OPEN RACE WINDOW],\nthen:\n\n3) rps_work() executes from the workqueue and may satisfy\n   \"(!pm_iir \u0026\u0026 !client_boost)\" test (in TIMER mode rps-\u003epm_iir\n   is zeroed by an earlier rps_work() call or never gets a new\n   value after previous intel_rps_unpark() event), so it jumps\n   to \"out\" label, bypassing intel_rps_is_active() guard and\n   executes gen6_gt_pm_unmask_irq();\n\n4) GT is parked and runtime PM wakelock is dropped, so only\n   a raw reference in __gt_park() -\u003e\n   intel_display_power_put_async() remains for 100ms, then the\n   MMIO write in gen6_gt_pm_unmask_irq() detects missing\n   wakelock via assert_rpm_wakelock_held() and emits\n   \"RPM wakelock ref not held during HW access\" tainting kernel.\n\nCommit 3e7abf814193 (\"drm/i915: Extract GT render power state management\")\ndropped the \"if (rps-\u003einterrupts_enabled)\" guard that\ngen6_pm_rps_work() had around this unmask in i915_irq.c.\nINTEL_RPS_ACTIVE brackets the same window, since it is set in\nintel_rps_unpark() before rps_enable_interrupts() and\nrps_start_timer() and cleared in intel_rps_park() before\nrps_stop_timer() and rps_disable_interrupts().\n\nSkip unmasking when RPS is no longer active (reaching unmask\noperation is independent of INTERRUPT mode). This does not\nprevent RPS operation from resuming on the next unpark.\nIn interrupt mode, intel_rps_unpark() calls\nrps_enable_interrupts(), which enables and unmasks the PM\ninterrupts. In timer mode, it calls rps_start_timer(),\nrestarting periodic engine-busyness evaluation. The timer\ngenerates software RPS events and queues rps_work() directly,\nindependently of PM interrupt delivery. Neither mode requires\nthe late worker to unmask interrupts while the GT is parked\n\n(cherry picked from commit ca4a6deadad15b91ee083afe445fa6bdbfb68206)",
  "id": "GHSA-vcpf-23w8-q6wv",
  "modified": "2026-10-23T15:31:34Z",
  "published": "2026-10-23T15:31:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99005"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/0b4a0fb98b9ffeac36798bbd369c821605cae70f"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/49d349c42cf5ebaa878d02699c632c9d883d935f"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5346b1cec6afa4f9b4b49a9f84e3cfef95a3f7bb"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/60f58da15f8c8e39706c564f9251de3626636dce"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/77abc1837c9651c8f43f7f7f336d10093eeb7745"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-99005 (GCVE-0-2026-99005)

FKIE_CVE-2026-99005

GHSA-VCPF-23W8-Q6WV

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour