Skip to content
Fencer Vulns
high 7.8

CVE-2026-31479 json

drm/xe: always keep track of remap prev/next

published 2026-04-22 6 mo ago modified 2026-10-19 20 d ago also EUVD-2026-24838

cvss
7.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.1%
EPSS 0.1% chance of exploitation in 30 days, percentile 2%
public exploits
0
none known

Summary

In the Linux kernel, the following vulnerability has been resolved:

drm/xe: always keep track of remap prev/next

During 3D workload, user is reporting hitting:

[ 413.361679] WARNING: drivers/gpu/drm/xe/xe_vm.c:1217 at vm_bind_ioctl_ops_unwind+0x1e2/0x2e0 [xe], CPU#7: vkd3d_queue/9925 [ 413.361944] CPU: 7 UID: 1000 PID: 9925 Comm: vkd3d_queue Kdump: loaded Not tainted 7.0.0-070000rc3-generic #202603090038 PREEMPT(lazy) [ 413.361949] RIP: 0010:vm_bind_ioctl_ops_unwind+0x1e2/0x2e0 [xe] [ 413.362074] RSP: 0018:ffffd4c25c3df930 EFLAGS: 00010282 [ 413.362077] RAX: 0000000000000000 RBX: ffff8f3ee817ed10 RCX: 0000000000000000 [ 413.362078] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 413.362079] RBP: ffffd4c25c3df980 R08: 0000000000000000 R09: 0000000000000000 [ 413.362081] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8f41fbf99380 [ 413.362082] R13: ffff8f3ee817e968 R14: 00000000ffffffef R15: ffff8f43d00bd380 [ 413.362083] FS: 00000001040ff6c0(0000) GS:ffff8f4696d89000(0000) knlGS:00000000330b0000 [ 413.362085] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 413.362086] CR2: 00007ddfc4747000 CR3: 00000002e6262005 CR4: 0000000000f72ef0 [ 413.362088] PKRU: 55555554 [ 413.362089] Call Trace: [ 413.362092] <TASK> [ 413.362096] xe_vm_bind_ioctl+0xa9a/0xc60 [xe]

Which seems to hint that the vma we are re-inserting for the ops unwind is either invalid or overlapping with something already inserted in the vm. It shouldn't be invalid since this is a re-insertion, so must have worked before. Leaving the likely culprit as something already placed where we want to insert the vma.

Following from that, for the case where we do something like a rebind in the middle of a vma, and one or both mapped ends are already compatible, we skip doing the rebind of those vma and set next/prev to NULL. As well as then adjust the original unmap va range, to avoid unmapping the ends. However, if we trigger the unwind path, we end up with three va, with the two ends never being removed and the original va range in the middle still being the shrunken size.

If this occurs, one failure mode is when another unwind op needs to interact with that range, which can happen with a vector of binds. For example, if we need to re-insert something in place of the original va. In this case the va is still the shrunken version, so when removing it and then doing a re-insert it can overlap with the ends, which were never removed, triggering a warning like above, plus leaving the vm in a bad state.

With that, we need two things here:

1) Stop nuking the prev/next tracking for the skip cases. Instead relying on checking for skip prev/next, where needed. That way on the unwind path, we now correctly remove both ends.

2) Undo the unmap va shrinkage, on the unwind path. With the two ends now removed the unmap va should expand back to the original size again, before re-insertion.

v2: - Update the explanation in the commit message, based on an actual IGT of triggering this issue, rather than conjecture. - Also undo the unmap shrinkage, for the skip case. With the two ends now removed, the original unmap va range should expand back to the original range. v3: - Track the old start/range separately. vma_size/start() uses the va info directly.

(cherry picked from commit aec6969f75afbf4e01fd5fb5850ed3e9c27043ac)

Patch / fix

  • Linux Linux 6.12.80, 6.18.21, 6.19.11, 7.0
  • linux Debian 13 6.12.85-1
  • linux Debian 14 6.19.11-1

debian advisories DEBIAN-CVE-2026-31479

  • linux-nvidia-tegra Ubuntu 24.04 LTS 6.8.0-1035.38

ubuntu advisories UBUNTU-CVE-2026-31479

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel RHEL 10.2 6.12.0-211.55.1.el10_2
  • rv RHEL 10.2 6.12.0-211.55.1.el10_2
  • perf RHEL 10.2 6.12.0-211.55.1.el10_2
  • rtla RHEL 10.2 6.12.0-211.55.1.el10_2
  • libperf RHEL 10.2 6.12.0-211.55.1.el10_2
  • kernel-rt RHEL 10.2 6.12.0-211.55.1.el10_2
  • kernel-64k RHEL 10.2 6.12.0-211.55.1.el10_2
  • kernel-core RHEL 10.2 6.12.0-211.55.1.el10_2

red hat advisories RHSA-2026:67471RHSA-2026:67150

  • kernel-64kb SLE Module for Basesystem 15 SP7 6.4.0-150700.53.73.2
  • kernel-syms SLE Module for Development Tools 15 SP7 6.4.0-150700.53.73.1
  • kernel-azure SLE Module for Public Cloud 15 SP7 6.4.0-150700.53.73.2
  • kernel-source SLE Module for Development Tools 15 SP7, SLE Module for Basesystem 15 SP7 6.4.0-150700.53.73.1
  • kernel-default SLE Workstation Extension 15 SP7, SLE Module for Legacy 15 SP7, SLE Module for Basesystem 15 SP7 +2 more 6.4.0-150700.53.73.2
  • kernel-zfcpdump SLE Module for Basesystem 15 SP7 6.4.0-150700.53.73.2
  • kernel-obs-build SLE Module for Development Tools 15 SP7 6.4.0-150700.53.73.2
  • kernel-default-base SLE Module for Basesystem 15 SP7 6.4.0-150700.53.73.2.150700.17.41.4

suse advisories SUSE-SU-2026:3166-1SUSE-SU-2026:22742-1SUSE-SU-2026:22769-1SUSE-SU-2026:22835-1SUSE-SU-2026:22812-1SUSE-SU-2026:3130-1

  • kernel-rt openSUSE Leap 16.0 6.12.0-160000.36.1
  • dtb-aarch64 openSUSE Leap 16.0 6.12.0-160000.36.1
  • kernel-64kb openSUSE Leap 16.0 6.12.0-160000.36.1
  • kernel-syms openSUSE Leap 16.0 6.12.0-160000.36.1
  • kernel-azure openSUSE Leap 16.0 6.12.0-160000.36.1
  • kernel-obs-qa openSUSE Leap 16.0 6.12.0-160000.36.1
  • kernel-source openSUSE Leap 16.0 6.12.0-160000.36.1
  • kernel-default openSUSE Leap 16.0 6.12.0-160000.36.1

opensuse advisories openSUSE-SU-2026:21388-1

  • kernel AlmaLinux 10 6.12.0-211.55.1.el10_2
  • rv AlmaLinux 10 6.12.0-211.55.1.el10_2
  • perf AlmaLinux 10 6.12.0-211.55.1.el10_2
  • rtla AlmaLinux 10 6.12.0-211.55.1.el10_2
  • libperf AlmaLinux 10 6.12.0-211.55.1.el10_2
  • kernel-rt AlmaLinux 10 6.12.0-211.55.1.el10_2
  • kernel-64k AlmaLinux 10 6.12.0-211.55.1.el10_2
  • kernel-core AlmaLinux 10 6.12.0-211.55.1.el10_2

almalinux advisories ALSA-2026:67471ALSA-2026:67150

  • kernel Rocky Linux 10 6.12.0-211.55.1.el10_2
  • kernel Rocky Linux 9 5.14.0-687.47.1.el9_8

rocky linux advisories RLSA-2026:67471RLSA-2026:67150

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-31479 updated cvss 7.1

kernel: drm/xe: always keep track of remap prev/next

  • Red Hat Enterprise Linux AppStream (v. 9) rv 5.14.0-687.47.1.el9_8, perf 5.14.0-687.47.1.el9_8, rtla 5.14.0-687.47.1.el9_8, python3-perf 5.14.0-687.47.1.el9_8, kernel-devel-matched 5.14.0-687.47.1.el9_8, kernel-64k-devel-matched 5.14.0-687.47.1.el9_8, +7 more
    fixed: vendor fix RHSA-2026:67150
  • Red Hat Enterprise Linux AppStream (v. 10) rv 6.12.0-211.55.1.el10_2, perf 6.12.0-211.55.1.el10_2, rtla 6.12.0-211.55.1.el10_2, python3-perf 6.12.0-211.55.1.el10_2, kernel-devel-matched 6.12.0-211.55.1.el10_2, kernel-64k-devel-matched 6.12.0-211.55.1.el10_2, +7 more
    fixed: vendor fix RHSA-2026:67471
  • Red Hat Enterprise Linux BaseOS (v. 9) kernel 5.14.0-687.47.1.el9_8, kernel-64k 5.14.0-687.47.1.el9_8, kernel-core 5.14.0-687.47.1.el9_8, kernel-tools 5.14.0-687.47.1.el9_8, kernel-modules 5.14.0-687.47.1.el9_8, kernel-64k-core 5.14.0-687.47.1.el9_8, +27 more
    fixed: vendor fix RHSA-2026:67150
  • Red Hat Enterprise Linux BaseOS (v. 10) kernel 6.12.0-211.55.1.el10_2, kernel-64k 6.12.0-211.55.1.el10_2, kernel-core 6.12.0-211.55.1.el10_2, kernel-tools 6.12.0-211.55.1.el10_2, kernel-modules 6.12.0-211.55.1.el10_2, kernel-64k-core 6.12.0-211.55.1.el10_2, +28 more
    fixed: vendor fix RHSA-2026:67471
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) libperf 5.14.0-687.47.1.el9_8, kernel-debuginfo-common-s390x 5.14.0-687.47.1.el9_8, kernel-debuginfo-common-x86_64 5.14.0-687.47.1.el9_8, kernel-debuginfo-common-aarch64 5.14.0-687.47.1.el9_8, kernel-debuginfo-common-ppc64le 5.14.0-687.47.1.el9_8
    fixed: vendor fix RHSA-2026:67150
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) libperf 6.12.0-211.55.1.el10_2, kernel-debuginfo-common-s390x 6.12.0-211.55.1.el10_2, kernel-debuginfo-common-x86_64 6.12.0-211.55.1.el10_2, kernel-debuginfo-common-aarch64 6.12.0-211.55.1.el10_2, kernel-debuginfo-common-ppc64le 6.12.0-211.55.1.el10_2
    fixed: vendor fix RHSA-2026:67471
  • Red Hat Enterprise Linux Real Time (v. 9) kernel-rt 5.14.0-687.47.1.el9_8, kernel-rt-64k 5.14.0-687.47.1.el9_8, kernel-rt-core 5.14.0-687.47.1.el9_8, kernel-rt-modules 5.14.0-687.47.1.el9_8, kernel-rt-64k-core 5.14.0-687.47.1.el9_8, kernel-rt-debug-core 5.14.0-687.47.1.el9_8, +14 more
    fixed: vendor fix RHSA-2026:67150
  • Red Hat Enterprise Linux Real Time (v. 10) kernel-rt 6.12.0-211.55.1.el10_2, kernel-rt-64k 6.12.0-211.55.1.el10_2, kernel-rt-core 6.12.0-211.55.1.el10_2, kernel-rt-modules 6.12.0-211.55.1.el10_2, kernel-rt-64k-core 6.12.0-211.55.1.el10_2, kernel-rt-debug-core 6.12.0-211.55.1.el10_2, +14 more
    fixed: vendor fix RHSA-2026:67471
show 3 more
  • Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt 5.14.0-687.47.1.el9_8, kernel-rt-core 5.14.0-687.47.1.el9_8, kernel-rt-modules 5.14.0-687.47.1.el9_8, kernel-rt-debug-core 5.14.0-687.47.1.el9_8, kernel-rt-modules-core 5.14.0-687.47.1.el9_8, kernel-rt-debug-modules 5.14.0-687.47.1.el9_8, +4 more
    fixed: vendor fix RHSA-2026:67150
  • Red Hat Enterprise Linux Real Time for NFV (v. 10) kernel-rt 6.12.0-211.55.1.el10_2, kernel-rt-core 6.12.0-211.55.1.el10_2, kernel-rt-modules 6.12.0-211.55.1.el10_2, kernel-rt-debug-core 6.12.0-211.55.1.el10_2, kernel-rt-modules-core 6.12.0-211.55.1.el10_2, kernel-rt-debug-modules 6.12.0-211.55.1.el10_2, +4 more
    fixed: vendor fix RHSA-2026:67471
  • Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 kernel-rt, kernel-rt-kvm, kernel-rt-core, kernel-rt-modules, kernel-rt-debug-kvm, kernel-rt-debug-core, +12 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
23 d ago

Exploit prediction

0.13% chance of exploitation in the next 30 days, higher than 2% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Linux Linux

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.