CVE-2026-23466

{"id": "CVE-2026-23466", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "919bb54e989c1edef87e9797be125c94c450fc65", "lessThan": "e2b424aadecb640f9e037b2891191cf8fd4c64cf", "versionType": "git"}, {"status": "affected", "version": "919bb54e989c1edef87e9797be125c94c450fc65", "lessThan": "1e9e2640d870d4837bcfdc220cb2c99ae5ee119f", "versionType": "git"}, {"status": "affected", "version": "919bb54e989c1edef87e9797be125c94c450fc65", "lessThan": "76326dc06d8793c2c81c31cc0115dbc348de2f88", "versionType": "git"}, {"status": "affected", "version": "919bb54e989c1edef87e9797be125c94c450fc65", "lessThan": "01f2557aa684e514005541e71a3d01f4cd45c170", "versionType": "git"}], "programFiles": ["drivers/gpu/drm/xe/xe_ggtt.c", "drivers/gpu/drm/xe/xe_ggtt_types.h"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.12"}, {"status": "unaffected", "version": "0", "lessThan": "6.12", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.78", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.20", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.10", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/gpu/drm/xe/xe_ggtt.c", "drivers/gpu/drm/xe/xe_ggtt_types.h"], "defaultStatus": "affected"}]}], "published": "2026-04-03T16:16:34.017", "references": [{"url": "https://git.kernel.org/stable/c/01f2557aa684e514005541e71a3d01f4cd45c170", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/1e9e2640d870d4837bcfdc220cb2c99ae5ee119f", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/76326dc06d8793c2c81c31cc0115dbc348de2f88", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/e2b424aadecb640f9e037b2891191cf8fd4c64cf", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Open-code GGTT MMIO access protection\n\nGGTT MMIO access is currently protected by hotplug (drm_dev_enter),\nwhich works correctly when the driver loads successfully and is later\nunbound or unloaded. However, if driver load fails, this protection is\ninsufficient because drm_dev_unplug() is never called.\n\nAdditionally, devm release functions cannot guarantee that all BOs with\nGGTT mappings are destroyed before the GGTT MMIO region is removed, as\nsome BOs may be freed asynchronously by worker threads.\n\nTo address this, introduce an open-coded flag, protected by the GGTT\nlock, that guards GGTT MMIO access. The flag is cleared during the\ndev_fini_ggtt devm release function to ensure MMIO access is disabled\nonce teardown begins.\n\n(cherry picked from commit 4f3a998a173b4325c2efd90bdadc6ccd3ad9a431)"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/xe: Implementaci\u00f3n directa de la protecci\u00f3n de acceso MMIO de GGTT\n\nEl acceso MMIO de GGTT est\u00e1 actualmente protegido por hotplug (drm_dev_enter), lo que funciona correctamente cuando el controlador se carga con \u00e9xito y luego se desvincula o descarga. Sin embargo, si la carga del controlador falla, esta protecci\u00f3n es insuficiente porque drm_dev_unplug() nunca se llama.\n\nAdem\u00e1s, las funciones de liberaci\u00f3n de devm no pueden garantizar que todos los BOs con mapeos de GGTT sean destruidos antes de que se elimine la regi\u00f3n MMIO de GGTT, ya que algunos BOs pueden ser liberados asincr\u00f3nicamente por hilos de trabajo.\n\nPara abordar esto, se introduce un indicador de codificaci\u00f3n directa, protegido por el bloqueo de GGTT, que protege el acceso MMIO de GGTT. El indicador se borra durante la funci\u00f3n de liberaci\u00f3n de devm dev_fini_ggtt para asegurar que el acceso MMIO se deshabilite una vez que comienza el desmantelamiento.\n\n(seleccionado de la confirmaci\u00f3n 4f3a998a173b4325c2efd90bdadc6ccd3ad9a431)"}], "lastModified": "2026-07-24T22:10:00.140", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CF16B1DB-0D79-4F76-8B3C-57C79AB99F70", "versionEndExcluding": "6.12.78", "versionStartIncluding": "6.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E5571059-6552-48E7-9BEF-3E358C387171", "versionEndExcluding": "6.18.20", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "96D34333-38BE-4414-9E79-6EB764329581", "versionEndExcluding": "6.19.10", "versionStartIncluding": "6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}