{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-97620 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-97620 is a vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-97620 and fix it if it is affected.\n\nWhat it is: CVE-2026-97620 is a vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-97620 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-97620/ (Markdown: https://insights.sbomify.com/CVE-2026-97620/index.md)","id":"CVE-2026-97620","markdown":"https://insights.sbomify.com/CVE-2026-97620/index.md","name":"CVE-2026-97620","record":{"aliases":["BELL-CVE-2026-97620","DEBIAN-CVE-2026-97620","GHSA-27vj-fv42-fgqc","UBUNTU-CVE-2026-97620"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["data_read"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel driver","requires_auth":"none","summary":"Local attackers can read stale data from the GPU cache due to missing flushes, potentially leaking sensitive information from reclaimed memory.","user_interaction":"not_required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Flush LSC untyped L1 dataport cache after rcs/ccs batches\n\nemit_render_cache_flush() sets PIPE_CONTROL0_HDC_PIPELINE_FLUSH to\nflush the L2/HDC data cache before fence signalling, but it never\nrequests a flush of the LSC untyped L1 data cache via the 'Untyped\nData-Port Cache Flush Enable' bit in PIPE_CONTROL DWord0[11].\n\nPer the Bspec, in 3D pipeline mode HDC Pipeline Flush is documented to\nalso flush/invalidate the untyped L1 cache, but only depending on how\nHDC_CHICKEN0[13:11] is programmed. Starting with MTL, this coupling\nbetween HDC Pipeline Flush and the untyped L1 cache flush no longer\nholds in practice, regardless of how HDC_CHICKEN0 is programmed, so\nrelying on it is not safe on newer platforms such as BMG. Mesa's Vulkan\ndriver (anv) has been assuming the kernel flushes both caches between\nsubmissions, and hit user-visible corruption in apps such as Llama.cpp\nbecause of this gap; it now works around it by flushing both caches\nagain from userspace at the end of every command buffer.\n\nCorrectness between submissions on the same queue is userspace's\nresponsibility and belongs in Mesa, not the kernel. However, for\nsecurity we must ensure stale data can't leak through the untyped L1\ndataport cache once memory is reclaimed or evicted, which requires the\nKMD to flush it before releasing memory for reuse.\n\nPrior to MTL, HDC_CHICKEN0 could be programmed (as already done for\nDG2 via Wa_22010960976/Wa_14013347512) to reliably keep HDC Pipeline\nFlush coupled to the untyped L1 cache flush, so those platforms are\nunaffected. Mesa's own anv driver found that on MTL the HW\ndisconnected the two independently of how HDC_CHICKEN0 is programmed,\nand could not bring the old behavior back even by writing the register\nby hand; see Mesa commit 7c2ff46a4fc3 (\"anv: don't prevent L1 untyped\ncache flush in 3D mode\"). The kernel can't reliably request the flush\nfrom the CS on MTL either, so restrict the new PIPE_CONTROL bit to\nGRAPHICS_VERx100 \u003e= 2000 (Xe2 and later), where it can be relied on.\n\nExplicitly set PIPE_CONTROL0_UNTYPED_DATAPORT_CACHE_FLUSH together\nwith PIPE_CONTROL0_HDC_PIPELINE_FLUSH in emit_render_cache_flush() on\nXe2 and later, so the L1 data cache is known clean before memory is\nreleased for reuse, without depending on undocumented\nplatform-specific HDC_CHICKEN0 behavior.\n\nBspec: 56551\n(cherry picked from commit 434514b6fe731e873808297c268fc52cdf4a1ce6)","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"drm/xe: Flush LSC untyped L1 dataport cache after rcs/ccs batches","id":"CVE-2026-97620","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"information_disclosure","year":"2026"},"n_packages":0,"n_references":4,"next":{"headline":"drm/rockchip: analogix_dp: fix unchecked bound endpoint name length","id":"CVE-2026-97621"},"packages":[],"prev":{"headline":"io_uring/rw: end write accounting from -\u003eki_complete","id":"CVE-2026-97619"},"products":["Linux"],"published":"2026-09-25","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"Local attackers can read stale data from the GPU cache due to missing flushes, potentially leaking sensitive information from reclaimed memory.","url":"https://insights.sbomify.com/CVE-2026-97620/"}