CVE-2026-31547: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31547 is a missing runtime PM (Power Management) reference vulnerability in the Linux kernel's drm/xe GPU driver. The flaw exists in the ccs_mode_store() function, which calls xe_gt_reset() without first acquiring an outer runtime PM reference, triggering kernel warnings and potential instability. It affects Linux kernel versions 6.19 through 6.19.9 and 7.0-rc1 through 7.0-rc7. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla). It was publicly disclosed on April 24, 2026.

The root cause is classified as CWE-911 (Improper Update of Reference Count): ccs_mode_store() invokes xe_gt_reset(), which internally calls xe_pm_runtime_get_noresume(). This inner function requires the caller to already hold an outer runtime PM reference, but none is acquired before the call, resulting in a kernel WARNING at xe_pm.c:885. The fix applies a scope-based guard(xe_pm_runtime)(xe) wrapper around the xe_gt_reset() call, ensuring the runtime PM reference is properly held for the duration of the reset operation. Exploitation requires local access with low privileges (e.g., write access to the ccs_mode sysfs attribute) (Red Hat Bugzilla, Red Hat Advisory).

Successful exploitation by a local low-privileged user can cause kernel warnings, GPU reset failures, and system instability, resulting in a denial-of-service condition affecting availability. There is no impact on confidentiality or integrity. The scope is limited to the local system running an affected kernel with Intel Xe GPU hardware, and lateral movement or data exfiltration are not applicable to this vulnerability (Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Red Hat Advisory). The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and low privileges, significantly limiting the attack surface.

• Logs: Kernel log entries containing [drm] Missing outer runtime PM protection and WARNING: drivers/gpu/drm/xe/xe_pm.c:885 at xe_pm_runtime_get_noresume+0x8b/0xc0 associated with the xe PCI device (e.g., xe 0000:03:00.0).
• Process/System Behavior: Unexpected GPU reset events or system instability on hosts with Intel Xe GPUs running kernel versions 6.19–6.19.9 or 7.0-rc1 through 7.0-rc7.
• File System: Unusual or repeated writes to the ccs_mode sysfs attribute for the Xe GPU device by low-privileged users.

Update to Linux kernel version 6.19.10 or later, which includes the fix via commits 65d046b2d8e0d6d855379a981869005fd6b6a41b and c409ecce9adcf815e86bc2f68834982e5a9c4e76 on git.kernel.org. SUSE has also released security updates addressing this CVE (SUSE-SU-2026:21834-1, SUSE-SU-2026:2217-1, SUSE-SU-2026:2238-1). As a workaround, restrict local user access to sysfs attributes for the Xe GPU driver on affected systems where patching is not immediately possible (Red Hat Advisory, Red Hat Bugzilla).