CVE-2026-98391 drm/xe: Guard page-fault worker with runtime PM check
A race condition in the Linux kernel's Xe GPU driver can cause a system crash when a page-fault worker accesses a suspended device during VM teardown.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98391?
CVE-2026-98391 is a denial of service vulnerability in Linux, published on 14 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/xe: Guard page-fault worker with runtime PM check
During VM teardown, the VM's runtime PM reference is dropped asynchronously, allowing the device to autosuspend while stale page faults belonging to the now-dead VM are still queued. When the page-fault worker later tries to ack one of these, it calls into guc_ct_send_locked() on an already-suspended device, tripping:
Assertion `!xe_pm_runtime_suspended(xe)` failed! WARNING at xe_device.c:1267 xe_device_assert_mem_access+0x11c/0x140 [xe]
A live VM/exec queue always holds a PM reference while it has outstanding work, so if the device is suspended at ack time, the owning context is already gone and the fault is stale.
Take a runtime PM reference across the entire pagefault queue worker to safely deliver acks for torn-down VMs.
v3: - Move PM ref to the generic xe_pagefault_queue_work using guard(xe_pm_runtime)(xe) instead of tracking it in the GuC backend(Matt Brost).
v2: - Hold PM ref across the entire batch (begin/end) instead of per-ack. This prevents the device from autosuspending mid-batch, which would leave write_only acks written but the end flush skipped, and skip counter++, desyncing the cadence check.(Himal) - Add a comment explaining stale faults.(Himal)
(cherry picked from commit fcc2431d2213dc4d04250c4f1ae87d9c3ae0d455) [Rodrigo: Added xe_device struct for compatibility while cherry-picking]
Which versions are affected by CVE-2026-98391?
How do I fix CVE-2026-98391?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-98391 being exploited?
There is no known exploitation of CVE-2026-98391 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-98391, GHSA-v93p-6w5h-wmxx, UBUNTU-CVE-2026-98391.