{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-72360","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-08-09T03:40:39.921Z","datePublished":"2026-08-15T05:56:00.076Z","dateUpdated":"2026-08-17T05:43:17.664Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-17T05:43:17.664Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/pf: Don't attempt to process FAST_REQ or EVENT relays\n\nCurrently defined VF/PF relay actions use regular REQUEST messages\nonly and the PF shouldn't attempt to handle FAST_REQUEST nor EVENT\nmessages as this would result in breaking the VFPF ABI protocol\nand also might trigger an assert on the PF side.\n\n(cherry picked from commit 1714d360fc5ae2e0886a69e979095d9c7ff3568a)"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - A malicious VM guest with an assigned Intel Xe SR-IOV VF reaches the bug by sending crafted GuC relay messages through the local VF-to-PF driver path (guest kernel/driver to host PF via GuC), not over a remote network protocol.\nAC:L - Once assigned an Xe SR-IOV VF, a cloud GPU tenant can reliably inject FAST_REQUEST or EVENT relay messages (e.g., via a modified guest driver) and control both sides of the transaction without uncontrollable timing or memory-layout races.\nPR:L - Exploitation requires tenant-level access to a VM with a passthrough Xe SR-IOV VF (typically root or a custom guest kernel/driver to craft non-REQUEST relay types) but does not require host administrator privileges on the PF.\nUI:N - No separate victim action is required; the attacker triggers the flaw directly by sending malformed FAST_REQUEST or EVENT relay messages from their own guest environment.\nS:C - A malicious VF guest causes the host PF kernel driver to mishandle GuC relay messages, crossing the VM/hypervisor security boundary in SR-IOV GPU virtualization (guest-to-host impact on the PF).\nC:N - No memory corruption or out-of-band read occurs; VF2PF handshake and runtime-query handlers return the same bounded register data as legitimate REQUEST messages, with no additional confidentiality impact.\nI:H - FAST_REQUEST and EVENT messages are type-confused with REQUEST and routed to xe_gt_sriov_pf_service_process_request(), causing the PF to emit protocol-invalid responses that corrupt host VF/PF relay and GuC communication state.\nA:H - Violating the VF/PF relay ABI by replying to EVENT/FAST_REQUEST messages can desynchronize host GuC relay handling and trigger PF asserts (drm_WARN on debug builds), risking host GPU driver failure or denial of service affecting all tenants on the device."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/xe/xe_guc_relay.c"],"versions":[{"version":"98e62805921cebcd2fcac3692037ca2ebef63b4a","lessThan":"499be4b5d64209e9f18c9442f9fbeef7155ae900","status":"affected","versionType":"git"},{"version":"98e62805921cebcd2fcac3692037ca2ebef63b4a","lessThan":"adc7dda728ca3e340a413e3bbc10cf159e1866a4","status":"affected","versionType":"git"},{"version":"98e62805921cebcd2fcac3692037ca2ebef63b4a","lessThan":"a4208d8032abd7f591581994f31e23b80b8fe659","status":"affected","versionType":"git"},{"version":"98e62805921cebcd2fcac3692037ca2ebef63b4a","lessThan":"ed8b0d731892c68b41ecbd27c952af284816dec1","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/xe/xe_guc_relay.c"],"versions":[{"version":"6.11","status":"affected"},{"version":"0","lessThan":"6.11","status":"unaffected","versionType":"semver"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"6.12.97"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"6.18.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/499be4b5d64209e9f18c9442f9fbeef7155ae900"},{"url":"https://git.kernel.org/stable/c/adc7dda728ca3e340a413e3bbc10cf159e1866a4"},{"url":"https://git.kernel.org/stable/c/a4208d8032abd7f591581994f31e23b80b8fe659"},{"url":"https://git.kernel.org/stable/c/ed8b0d731892c68b41ecbd27c952af284816dec1"}],"title":"drm/xe/pf: Don't attempt to process FAST_REQ or EVENT relays","x_generator":{"engine":"bippy-1.2.0"}}}}