---
id: CVE-2026-74440
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/xe: Wait on external BO kernel fences in exec IOCTL

  Before arming a user job, xe_exec_ioctl() only added the VM's
  dma-resv KERNEL slot as a dependency
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/xe: Wait on external BO kernel fences in exec IOCTL

  Before arming a user job, xe_exec_ioctl() only added the VM's
  dma-resv KERNEL slot as a dependency. That slot c…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= dd08ebf6c3525a7ea2186e636df064ea47281987 <
    1738db550334adca0e7fcf0ef684198fb7462779
  - >-
    Linux >= dd08ebf6c3525a7ea2186e636df064ea47281987 <
    21976fe5258494ac38b63d103be81bf1180ae4ae
  - >-
    Linux >= dd08ebf6c3525a7ea2186e636df064ea47281987 <
    5d363d00bc9799b90a0dc89eb1c5dcb909c042ee
  - >-
    Linux >= dd08ebf6c3525a7ea2186e636df064ea47281987 <
    af80e2bfde9312c76b60cf9274248dce0410b30d
  - Linux 6.8
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T20:17:27.800'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-74440'
references:
  - url: 'https://git.kernel.org/stable/c/1738db550334adca0e7fcf0ef684198fb7462779'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/21976fe5258494ac38b63d103be81bf1180ae4ae'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5d363d00bc9799b90a0dc89eb1c5dcb909c042ee'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/af80e2bfde9312c76b60cf9274248dce0410b30d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00129
epssPercentile: 0.02491
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T18:56:28.751745Z'
ingestedAt: '2026-10-16T19:46:24.363Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/xe: Wait on external BO kernel fences in exec IOCTL

Before arming a user job, xe_exec_ioctl() only added the VM's
dma-resv KERNEL slot as a dependency. That slot covers rebinds and
the kernel operations of the VM's private BOs, but not external BOs
(bo->vm == NULL), which carry their kernel operations (evictions,
moves, ...) in their own dma-resv KERNEL slot.

The DMA_RESV_USAGE_KERNEL slot is the cross-driver contract for
memory management operations that must complete before the BO or its
backing store may be used: any accessor is required to wait on the
KERNEL fences before touching the resv. By skipping the external BOs'
KERNEL slots, the exec path violated that contract and could schedule
a user job while a kernel operation on an external BO mapped by the VM
was still in flight, racing against it and potentially reading or
writing memory that was being moved.

Replace the VM-only dependency with an iteration over every object
locked by the exec, adding each object's KERNEL slot as a job
dependency. This covers the VM resv (rebinds and private BOs) as well
as every external BO, mirroring the drm_gpuvm_resv_add_fence() call
that later publishes the job fence to the same set of objects.
Long-running mode continues to skip this, as before.

(cherry picked from commit a6b842acf3ddd1efc53a56de9260cfa718fb35e7)

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.