CVE-2026-74440

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/xe: Wait on external BO kernel fences in exec IOCTL<br /> <br /> Before arming a user job, xe_exec_ioctl() only added the VM&amp;#39;s<br /> dma-resv KERNEL slot as a dependency. That slot covers rebinds and<br /> the kernel operations of the VM&amp;#39;s private BOs, but not external BOs<br /> (bo-&gt;vm == NULL), which carry their kernel operations (evictions,<br /> moves, ...) in their own dma-resv KERNEL slot.<br /> <br /> The DMA_RESV_USAGE_KERNEL slot is the cross-driver contract for<br /> memory management operations that must complete before the BO or its<br /> backing store may be used: any accessor is required to wait on the<br /> KERNEL fences before touching the resv. By skipping the external BOs&amp;#39;<br /> KERNEL slots, the exec path violated that contract and could schedule<br /> a user job while a kernel operation on an external BO mapped by the VM<br /> was still in flight, racing against it and potentially reading or<br /> writing memory that was being moved.<br /> <br /> Replace the VM-only dependency with an iteration over every object<br /> locked by the exec, adding each object&amp;#39;s KERNEL slot as a job<br /> dependency. This covers the VM resv (rebinds and private BOs) as well<br /> as every external BO, mirroring the drm_gpuvm_resv_add_fence() call<br /> that later publishes the job fence to the same set of objects.<br /> Long-running mode continues to skip this, as before.<br /> <br /> (cherry picked from commit a6b842acf3ddd1efc53a56de9260cfa718fb35e7)