{"id":"CVE-2026-99005","summary":"drm/i915/gt: Unmask interrupts only when ACTIVE is true","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gt: Unmask interrupts only when ACTIVE is true\n\nThere is a small race window between intel_rps_boost() reading\na stale ACTIVE state and queuing rps-\u003ework, where ACTIVE may be\nchanged via asynchronous calls triggered by wakeref drop.\nThis means that rps_work() could be triggered after the GT has\nbeen parked, so unmasking RPS PM interrupts would happen without\nholding PM wakelock. This sequence of events may be observed\nduring live_rc6_ctx_wa() selftest:\n\n1) live_rc6_ctx_wa()\n   -\u003e intel_engine_pm_put()\n      -\u003e wakeref_put()\n\nASYNC1) wakeref_put() callback\n          -\u003e __engine_park()\n             -\u003e intel_gt_pm_put_async()\n                -\u003e intel_gt_pm_put_async_untracked()\n                   -\u003e intel_wakeref_put_async()\n\nASYNC2) wakeref_put_async() callback\n          -\u003e __gt_park()\n             -\u003e intel_rps_park()\n                -\u003e intel_rps_clear_active() [clear ACTIVE]\n                WITH INTERRUPTS:\n                -\u003e rps_disable_interrupts()\n                   -\u003e cancel_work_sync(rps-\u003ework)\n                   -\u003e rps_reset_interrupts() [rps-\u003epm_iir = 0]\n                WITHOUT INTERRUPTS (TIMER mode):\n                -\u003e rps_stop_timer()\n                   -\u003e cancel_work_sync(rps-\u003ework)\n\n2) live_rc6_ctx_wa()\n   -\u003e intel_gt_wait_for_idle()\n      -\u003e intel_gt_retire_requests_timeout()\n         -\u003e dma_fence_wait_timeout()\n            -\u003e ops-\u003ewait() [i915_fence_wait()]\n               -\u003e i915_request_wait_timeout()\n                  -\u003e intel_rps_boost()\n                     -\u003e intel_rps_is_active() [check ACTIVE]\n                        [OPEN RACE WINDOW]\n                     -\u003e queue_work(rps-\u003ework)\n         -\u003e retire_requests()\n            -\u003e i915_request_retire()\n               -\u003e intel_rps_dec_waiters() [from 1 to 0]\n\nIf ASYNC1 and ASYNC2 would execute during [OPEN RACE WINDOW],\nthen:\n\n3) rps_work() executes from the workqueue and may satisfy\n   \"(!pm_iir && !client_boost)\" test (in TIMER mode rps-\u003epm_iir\n   is zeroed by an earlier rps_work() call or never gets a new\n   value after previous intel_rps_unpark() event), so it jumps\n   to \"out\" label, bypassing intel_rps_is_active() guard and\n   executes gen6_gt_pm_unmask_irq();\n\n4) GT is parked and runtime PM wakelock is dropped, so only\n   a raw reference in __gt_park() -\u003e\n   intel_display_power_put_async() remains for 100ms, then the\n   MMIO write in gen6_gt_pm_unmask_irq() detects missing\n   wakelock via assert_rpm_wakelock_held() and emits\n   \"RPM wakelock ref not held during HW access\" tainting kernel.\n\nCommit 3e7abf814193 (\"drm/i915: Extract GT render power state management\")\ndropped the \"if (rps-\u003einterrupts_enabled)\" guard that\ngen6_pm_rps_work() had around this unmask in i915_irq.c.\nINTEL_RPS_ACTIVE brackets the same window, since it is set in\nintel_rps_unpark() before rps_enable_interrupts() and\nrps_start_timer() and cleared in intel_rps_park() before\nrps_stop_timer() and rps_disable_interrupts().\n\nSkip unmasking when RPS is no longer active (reaching unmask\noperation is independent of INTERRUPT mode). This does not\nprevent RPS operation from resuming on the next unpark.\nIn interrupt mode, intel_rps_unpark() calls\nrps_enable_interrupts(), which enables and unmasks the PM\ninterrupts. In timer mode, it calls rps_start_timer(),\nrestarting periodic engine-busyness evaluation. The timer\ngenerates software RPS events and queues rps_work() directly,\nindependently of PM interrupt delivery. Neither mode requires\nthe late worker to unmask interrupts while the GT is parked\n\n(cherry picked from commit ca4a6deadad15b91ee083afe445fa6bdbfb68206)","modified":"2026-11-04T14:27:27.516580304Z","published":"2026-10-23T12:20:30.462Z","related":["SUSE-SU-2026:5091-1"],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/99xxx/CVE-2026-99005.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/0b4a0fb98b9ffeac36798bbd369c821605cae70f"},{"type":"WEB","url":"https://git.kernel.org/stable/c/0eb18add8cd84b4d7a6caa71e78cbe5faa912498"},{"type":"WEB","url":"https://git.kernel.org/stable/c/49d349c42cf5ebaa878d02699c632c9d883d935f"},{"type":"WEB","url":"https://git.kernel.org/stable/c/5346b1cec6afa4f9b4b49a9f84e3cfef95a3f7bb"},{"type":"WEB","url":"https://git.kernel.org/stable/c/60f58da15f8c8e39706c564f9251de3626636dce"},{"type":"WEB","url":"https://git.kernel.org/stable/c/77abc1837c9651c8f43f7f7f336d10093eeb7745"},{"type":"WEB","url":"https://git.kernel.org/stable/c/8833daaa6f2102b4d527711d09cd72741601242a"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c2c2bab5eeb227c0c45d971c58a5f66661e7bb8a"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/99xxx/CVE-2026-99005.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99005"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"3e7abf8141935ded77abeb622480bf4a14241ece"},{"fixed":"c2c2bab5eeb227c0c45d971c58a5f66661e7bb8a"},{"fixed":"0eb18add8cd84b4d7a6caa71e78cbe5faa912498"},{"fixed":"8833daaa6f2102b4d527711d09cd72741601242a"},{"fixed":"77abc1837c9651c8f43f7f7f336d10093eeb7745"},{"fixed":"60f58da15f8c8e39706c564f9251de3626636dce"},{"fixed":"0b4a0fb98b9ffeac36798bbd369c821605cae70f"},{"fixed":"49d349c42cf5ebaa878d02699c632c9d883d935f"},{"fixed":"5346b1cec6afa4f9b4b49a9f84e3cfef95a3f7bb"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-99005.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.0"},{"fixed":"5.10.273"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.224"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.191"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.160"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.113"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.57"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.11"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-99005.json"}}],"schema_version":"1.9.2"}