Linux kernel (drm/xe) vulnerabilities

In the Linux kernel's drm/xe/shrinker component, a bug was found where __xe_shrinker_walk() walks the SYSTEM and TT LRUs without a runtime PM reference. Shrinking a buffer object outside system memory invalidates its GPU mappings, which requires the device to be resumed — while runtime suspended this trips an assertion warning and the TLB invalidation returns -ENODEV.

In the Linux kernel, the drm/xe driver's emit_render_cache_flush() did not request a flush of the LSC untyped L1 dataport cache before releasing memory for reuse. Starting with MTL, the coupling between HDC Pipeline Flush and the untyped L1 cache flush no longer holds reliably, potentially allowing stale data to leak. The fix explicitly sets PIPE_CONTROL0_UNTYPED_DATAPORT_CACHE_FLUSH on Xe2 and later platforms.

A bug in the Linux kernel's drm/xe component caused get_flat_ccs_offset() to round the end of usable VRAM upwards, exposing memory belonging to the hardware compression (flat CCS) region to the VRAM allocator as free memory. The compression hardware then overwrote data in that area without the driver's knowledge, corrupting page tables and hanging the compositor (black screen). The issue primarily affects Intel Battlemage G21 hardware.