VulnerabilityPublished 25 Sep 2026Updated 19 Oct 2026

CVE-2026-97620: Linux kernel · drm/xe: Flush LSC untyped L1 dataport cache after rcs/ccs batches

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in fab569a69c3ae9beced68307e36048efa2709bec : patch Linux kernel soon.

Data as of 26 Oct 2026, 14:05 UTC

Severity

High

Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD

EPSS: 0.2% chance of exploitation in 30 days – higher than 10% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in fab569a69c3ae9beced68307e36048efa2709bec, f5fcf7e638b904397ec0f66d3ea6766ef0cfe25b, d73975c121f56fe3fcbbfcfe3ea8853b9f597ab3 +1

Exploitation evidence

Disclosed: evidence found.
CVE published 25 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Linux kernel to fab569a69c3ae9beced68307e36048efa2709bec, f5fcf7e638b904397ec0f66d3ea6766ef0cfe25b, d73975c121f56fe3fcbbfcfe3ea8853b9f597ab3 or 92393fc5227b2b701f2b1530c9cd6dac6ee90b71.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 9f8f93bee3efdba3bf7853befe2219e3a300c305, < fab569a69c3ae9beced68307e36048efa2709bec	Fixed in fab569a69c3ae9beced68307e36048efa2709bec
LinuxLinux	Affected ≥ 9f8f93bee3efdba3bf7853befe2219e3a300c305, < f5fcf7e638b904397ec0f66d3ea6766ef0cfe25b	Fixed in f5fcf7e638b904397ec0f66d3ea6766ef0cfe25b
LinuxLinux	Affected ≥ 9f8f93bee3efdba3bf7853befe2219e3a300c305, < d73975c121f56fe3fcbbfcfe3ea8853b9f597ab3	Fixed in d73975c121f56fe3fcbbfcfe3ea8853b9f597ab3
LinuxLinux	Affected ≥ 9f8f93bee3efdba3bf7853befe2219e3a300c305, < 92393fc5227b2b701f2b1530c9cd6dac6ee90b71	Fixed in 92393fc5227b2b701f2b1530c9cd6dac6ee90b71
LinuxLinux	Affected =6.8	Fixed in–

AI-suggested

A fix is available and included in Linux kernel version 6.8 and specific commits referenced. Users and administrators should update to Linux kernel 6.8 or later to ensure the untyped L1 dataport cache is properly flushed, preventing stale data leakage. No additional user-space mitigations are required once the kernel is updated.

Description

CVE-2026-97620 addresses a vulnerability in the Linux kernel's drm/xe driver where the LSC untyped L1 dataport cache was not flushed after certain GPU command batches, potentially allowing stale data to leak. The issue arises because the kernel's cache flush mechanism did not explicitly flush this L1 cache on newer Intel Xe platforms (starting with Meteor Lake), relying instead on hardware behavior that no longer holds. The flaw was fixed by explicitly flushing the untyped L1 cache on affected platforms before memory is released for reuse.

Impact

Without the explicit flush of the untyped L1 dataport cache, stale data could potentially leak when memory is reclaimed or reused, posing a security risk. This could lead to data corruption or unintended data disclosure in GPU workloads using the drm/xe driver on affected Intel Xe platforms starting with Meteor Lake. The issue affects the integrity and confidentiality of GPU memory operations.

Summary

The vulnerability in the Linux kernel drm/xe driver involves the failure to flush the LSC untyped L1 dataport cache after render command stream (rcs) and compute command stream (ccs) batches. Previously, the kernel relied on the PIPE_CONTROL0_HDC_PIPELINE_FLUSH bit to flush the L2/HDC cache and assumed this also flushed the untyped L1 cache. However, starting with Intel Meteor Lake (MTL) and later platforms like BMG, this coupling no longer occurs, leading to potential stale data exposure. Mesa's Vulkan driver worked around this by flushing caches from userspace, but for security, the kernel must ensure the untyped L1 cache is flushed before memory reuse. The fix explicitly sets the PIPE_CONTROL0_UNTYPED_DATAPORT_CACHE_FLUSH bit alongside PIPE_CONTROL0_HDC_PIPELINE_FLUSH on Xe2 and later platforms, ensuring the L1 cache is clean. Earlier platforms remain unaffected due to hardware workarounds. The fix is included in Linux kernel version 6.8 and related commits.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 13:36 UTC

Technical details

References

Community reviews

Related threats