CVE-2025-21880

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/userptr: fix EFAULT handling

Currently we treat EFAULT from hmm_range_fault() as a non-fatal error

when called from xe_vm_userptr_pin() with the idea that we want to avoid

killing the entire vm and chucking an error, under the assumption that

the user just did an unmap or something, and has no intention of

actually touching that memory from the GPU. At this point we have

already zapped the PTEs so any access should generate a page fault, and

if the pin fails there also it will then become fatal.

However it looks like it's possible for the userptr vma to still be on

the rebind list in preempt_rebind_work_func(), if we had to retry the

pin again due to something happening in the caller before we did the

rebind step, but in the meantime needing to re-validate the userptr and

this time hitting the EFAULT.

This explains an internal user report of hitting:

[ 191.738349] WARNING: CPU: 1 PID: 157 at drivers/gpu/d

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References