ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-98391

drm/xe: Guard page-fault worker with runtime PM check

Published Oct 14, 2026 · catalog updated Oct 15, 2026 · drm/xe: Guard page-fault worker

Check if you run it

No confirmed exploitation is on record for CVE-2026-98391. EPSS is 0.20%. Act only if a listed version of drm/xe: Guard page-fault worker is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (drm/xe: Guard page-fault worker).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Medium—
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.20%
Remediation
Advisory link
Affected products
Linux Kernel

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Guard page-fault worker with runtime PM check During VM teardown, the VM's runtime PM reference is dropped asynchronously, allowing the device to autosuspend while stale page faults belonging to the now-dead VM are still queued. When the page-fault worker later tries to ack one of these, it calls into guc_ct_send_locked() on an already-suspended device, tripping: Assertion failed! WARNING at xe_device.c:1267 xe_device_assert_mem_access+0x11c/0x140 [xe] A live VM/exec queue always holds a PM reference while it has outstanding work, so if the device is suspended at ack time, the owning context is already gone and the fault is stale. Take a runtime PM reference across the entire pagefault queue worker to safely deliver acks for torn-down VMs. v3: - Move PM ref to the generic xe_pagefault_queue_work using guard(xe_pm_runtime)(xe) instead of tracking it in the GuC backend(Matt Brost). v2: - Hold PM ref across the entire batch (begin/end) instead of per-ack. This prevents the device from autosuspending mid-batch, which would leave write_only acks written but the end flush skipped, and skip counter++, desyncing the cadence check.(Himal) - Add a comment explaining stale faults.(Himal) (cherry picked from commit fcc2431d2213dc4d04250c4f1ae87d9c3ae0d455) [Rodrigo: Added xe_device struct for compatibility while cherry-picking]

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Linux Kernel6.19.0 → 7.2.7

How to fix CVE-2026-98391

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-98391. EPSS is 0.20%. Act only if a listed version of drm/xe: Guard page-fault worker is installed.

Which versions are affected?

Compare what you have installed with Kernel 6.19.0 → 7.2.7. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

No weakness class is stored. EPSS 0.20%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 14, 2026 · OpenSSF OSV / OSV Scanner

    Detected

    In the Linux kernel, the following vulnerability has been resolved: drm/xe: Guard page-fault worker with runtime PM check During VM teardown, the VM's runtime PM reference is dropped asynchronously, allowing the device to autosuspend while stale page faults belonging to the now-dead VM are still queued. When the page-fault worker later tries to ack one of these, it calls into guc_ct_send_locked()

  2. Oct 15, 2026 · OpenSSF OSV / OSV Scanner

    Fix available

    Kernel fixed in 7.2.7

  3. Oct 15, 2026 · OpenSSF OSV / OSV Scanner

    Fix available

    Kernel fixed in 7.2.7

  4. Oct 15, 2026 · OpenSSF OSV / OSV Scanner

    Updated

    In the Linux kernel, the following vulnerability has been resolved: drm/xe: Guard page-fault worker with runtime PM check During VM teardown, the VM's runtime PM reference is dropped asynchronously, allowing the device to autosuspend while stale page faults belonging to the now-dead VM are still queued. When the page-fault worker later tries to ack one of these, it calls into guc_ct_send_locked()

Sources

  • CVE.orgVulnerability recordCVE-2026-98391

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-98391

    30-day exploitation probability 0.2%

    first.org
  • OpenSSF OSV / OSV ScannerPackage advisoryCVE-2026-98391

    drm/xe: Guard page-fault worker with runtime PM check

    osv.dev
  • Tenable CVE DatabaseVulnerability recordCVE-2026-98391

    In the Linux kernel, the following vulnerability has been resolved: drm/xe: Guard page-fault worker with runtime PM check During VM teardown, the VM's runtime PM reference is dropped asynchronously, allowing the device to autosuspend while stale page faults belonging to the now-dead VM are still queued. When the page-fault worker later tries to ack one of these, it calls into guc_ct_send_locked()

    tenable.com

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.