CVE-2026-80606

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/userptr: Hold notifier_lock for write on inject test path

When CONFIGDRMXEUSERPTRINVALINJECT=y, xeptsvmuserptrprecommit() runs vmacheckuserptr() with the svm notifierlock taken for read. The test injection causes vmacheckuserptr() to call xevmauserptrforceinvalidate(), which feeds into xevmauserptrdoinval() with drmgpusvmctx.innotifier=true. That flag tells drmgpusvmunmappages() the caller already holds notifierlock for write and only asserts the mode. Because the caller actually holds it for read, the assertion fires:

WARNING: drivers/gpu/drm/drmgpusvm.c:1669 at \ drmgpusvmunmappages+0xd4/0x130 [drmgpusvmhelper] Call Trace: xevmauserptrdoinval+0x40d/0xfd0 [xe] xevmauserptrinvalidatepass1+0x3e6/0x8d0 [xe] xevmauserptrforceinvalidate+0xde/0x290 [xe] vmacheckuserptr.constprop.0+0x1c6/0x220 [xe] xeptsvmuserptrprecommit+0x6a3/0xc60 [xe] ... xevmbindioctl+0x3a0a/0x4480 [xe]

Acquire notifierlock for write in pre-commit when the inject Kconfig is enabled, via new helpers xeptsvmuserptrnotifierlock()/unlock(). Rename xesvmassertheldread() to xesvmassertheldreadorinjectwrite() so it asserts the correct mode under each build configuration. Production builds (CONFIGDRMXEUSERPTRINVAL_INJECT=n) keep the existing read-mode behavior bit-for-bit.

(cherry picked from commit 80ccbd97ffee8ad2e73167d826fe7be548364365)