VULN/vuln-cve
1
0 Fork 0
Code Pull Requests Actions Activity
Files
c1444140e59c61ba154436ea0cd6284d8a97c3f0
vuln-cve/data/2026/99xxx/CVE-2026-99005.json
T

248 lines
15 KiB
JSON
Raw Blame History

{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-99005",
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"state": "PUBLISHED",
"assignerShortName": "Linux",
"dateReserved": "2026-09-25T10:25:14.385Z",
"datePublished": "2026-10-23T12:20:30.462Z",
"dateUpdated": "2026-10-30T12:40:49.182Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux",
"dateUpdated": "2026-10-30T12:40:49.182Z"
},
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gt: Unmask interrupts only when ACTIVE is true\n\nThere is a small race window between intel_rps_boost() reading\na stale ACTIVE state and queuing rps->work, where ACTIVE may be\nchanged via asynchronous calls triggered by wakeref drop.\nThis means that rps_work() could be triggered after the GT has\nbeen parked, so unmasking RPS PM interrupts would happen without\nholding PM wakelock. This sequence of events may be observed\nduring live_rc6_ctx_wa() selftest:\n\n1) live_rc6_ctx_wa()\n -> intel_engine_pm_put()\n -> wakeref_put()\n\nASYNC1) wakeref_put() callback\n -> __engine_park()\n -> intel_gt_pm_put_async()\n -> intel_gt_pm_put_async_untracked()\n -> intel_wakeref_put_async()\n\nASYNC2) wakeref_put_async() callback\n -> __gt_park()\n -> intel_rps_park()\n -> intel_rps_clear_active() [clear ACTIVE]\n WITH INTERRUPTS:\n -> rps_disable_interrupts()\n -> cancel_work_sync(rps->work)\n -> rps_reset_interrupts() [rps->pm_iir = 0]\n WITHOUT INTERRUPTS (TIMER mode):\n -> rps_stop_timer()\n -> cancel_work_sync(rps->work)\n\n2) live_rc6_ctx_wa()\n -> intel_gt_wait_for_idle()\n -> intel_gt_retire_requests_timeout()\n -> dma_fence_wait_timeout()\n -> ops->wait() [i915_fence_wait()]\n -> i915_request_wait_timeout()\n -> intel_rps_boost()\n -> intel_rps_is_active() [check ACTIVE]\n [OPEN RACE WINDOW]\n -> queue_work(rps->work)\n -> retire_requests()\n -> i915_request_retire()\n -> intel_rps_dec_waiters() [from 1 to 0]\n\nIf ASYNC1 and ASYNC2 would execute during [OPEN RACE WINDOW],\nthen:\n\n3) rps_work() executes from the workqueue and may satisfy\n \"(!pm_iir && !client_boost)\" test (in TIMER mode rps->pm_iir\n is zeroed by an earlier rps_work() call or never gets a new\n value after previous intel_rps_unpark() event), so it jumps\n to \"out\" label, bypassing intel_rps_is_active() guard and\n executes gen6_gt_pm_unmask_irq();\n\n4) GT is parked and runtime PM wakelock is dropped, so only\n a raw reference in __gt_park() ->\n intel_display_power_put_async() remains for 100ms, then the\n MMIO write in gen6_gt_pm_unmask_irq() detects missing\n wakelock via assert_rpm_wakelock_held() and emits\n \"RPM wakelock ref not held during HW access\" tainting kernel.\n\nCommit 3e7abf814193 (\"drm/i915: Extract GT render power state management\")\ndropped the \"if (rps->interrupts_enabled)\" guard that\ngen6_pm_rps_work() had around this unmask in i915_irq.c.\nINTEL_RPS_ACTIVE brackets the same window, since it is set in\nintel_rps_unpark() before rps_enable_interrupts() and\nrps_start_timer() and cleared in intel_rps_park() before\nrps_stop_timer() and rps_disable_interrupts().\n\nSkip unmasking when RPS is no longer active (reaching unmask\noperation is independent of INTERRUPT mode). This does not\nprevent RPS operation from resuming on the next unpark.\nIn interrupt mode, intel_rps_unpark() calls\nrps_enable_interrupts(), which enables and unmasks the PM\ninterrupts. In timer mode, it calls rps_start_timer(),\nrestarting periodic engine-busyness evaluation. The timer\ngenerates software RPS events and queues rps_work() directly,\nindependently of PM interrupt delivery. Neither mode requires\nthe late worker to unmask interrupts while the GT is parked\n\n(cherry picked from commit ca4a6deadad15b91ee083afe445fa6bdbfb68206)"
}
],
"affected": [
{
"product": "Linux",
"vendor": "Linux",
"defaultStatus": "unaffected",
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"programFiles": [
"drivers/gpu/drm/i915/gt/intel_rps.c"
],
"versions": [
{
"version": "3e7abf8141935ded77abeb622480bf4a14241ece",
"lessThan": "c2c2bab5eeb227c0c45d971c58a5f66661e7bb8a",
"status": "affected",
"versionType": "git"
},
{
"version": "3e7abf8141935ded77abeb622480bf4a14241ece",
"lessThan": "0eb18add8cd84b4d7a6caa71e78cbe5faa912498",
"status": "affected",
"versionType": "git"
},
{
"version": "3e7abf8141935ded77abeb622480bf4a14241ece",
"lessThan": "8833daaa6f2102b4d527711d09cd72741601242a",
"status": "affected",
"versionType": "git"
},
{
"version": "3e7abf8141935ded77abeb622480bf4a14241ece",
"lessThan": "77abc1837c9651c8f43f7f7f336d10093eeb7745",
"status": "affected",
"versionType": "git"
},
{
"version": "3e7abf8141935ded77abeb622480bf4a14241ece",
"lessThan": "60f58da15f8c8e39706c564f9251de3626636dce",
"status": "affected",
"versionType": "git"
},
{
"version": "3e7abf8141935ded77abeb622480bf4a14241ece",
"lessThan": "0b4a0fb98b9ffeac36798bbd369c821605cae70f",
"status": "affected",
"versionType": "git"
},
{
"version": "3e7abf8141935ded77abeb622480bf4a14241ece",
"lessThan": "49d349c42cf5ebaa878d02699c632c9d883d935f",
"status": "affected",
"versionType": "git"
},
{
"version": "3e7abf8141935ded77abeb622480bf4a14241ece",
"lessThan": "5346b1cec6afa4f9b4b49a9f84e3cfef95a3f7bb",
"status": "affected",
"versionType": "git"
}
]
},
{
"product": "Linux",
"vendor": "Linux",
"defaultStatus": "affected",
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"programFiles": [
"drivers/gpu/drm/i915/gt/intel_rps.c"
],
"versions": [
{
"version": "5.5",
"status": "affected"
},
{
"version": "0",
"lessThan": "5.5",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "5.10.273",
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "5.15.224",
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.1.191",
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.6.160",
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.12.113",
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.18.57",
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "7.2.11",
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "7.3",
"lessThanOrEqual": "*",
"status": "unaffected",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.5",
"versionEndExcluding": "5.10.273"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.5",
"versionEndExcluding": "5.15.224"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.5",
"versionEndExcluding": "6.1.191"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.5",
"versionEndExcluding": "6.6.160"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.5",
"versionEndExcluding": "6.12.113"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.5",
"versionEndExcluding": "6.18.57"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.5",
"versionEndExcluding": "7.2.11"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.5",
"versionEndExcluding": "7.3"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/c2c2bab5eeb227c0c45d971c58a5f66661e7bb8a"
},
{
"url": "https://git.kernel.org/stable/c/0eb18add8cd84b4d7a6caa71e78cbe5faa912498"
},
{
"url": "https://git.kernel.org/stable/c/8833daaa6f2102b4d527711d09cd72741601242a"
},
{
"url": "https://git.kernel.org/stable/c/77abc1837c9651c8f43f7f7f336d10093eeb7745"
},
{
"url": "https://git.kernel.org/stable/c/60f58da15f8c8e39706c564f9251de3626636dce"
},
{
"url": "https://git.kernel.org/stable/c/0b4a0fb98b9ffeac36798bbd369c821605cae70f"
},
{
"url": "https://git.kernel.org/stable/c/49d349c42cf5ebaa878d02699c632c9d883d935f"
},
{
"url": "https://git.kernel.org/stable/c/5346b1cec6afa4f9b4b49a9f84e3cfef95a3f7bb"
}
],
"title": "drm/i915/gt: Unmask interrupts only when ACTIVE is true",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
}
}
View Git Blame Copy Permalink