In the Linux kernel, the following vulnerability has been resolved: drm/i915: fix incorrect RCU teardown order i915_gem_busy_ioctl uses… (CVE-2026-98521)

The vulnerability in the Linux kernel drm/i915 subsystem arises from i915_gem_busy_ioctl using dma_resv_for_each_fence_unlocked() to iterate over fences without holding a reference, relying solely on the RCU read side lock. Concurrent destruction of the GEM object during this iteration leads to a scenario where dma_resv_for_each_fence_unlocked() encounters a destroyed dma_fence and restarts the loop indefinitely, causing an endless loop. The underlying problem is that no new fence list is installed after destruction, only the old one freed, preventing loop termination. The resolution is to defer dropping fence references until after the RCU grace period, ensuring safe teardown order and preventing the endless loop.

The vulnerability can cause the i915_gem_busy_ioctl function to enter an endless loop when a GEM object is destroyed concurrently during fence iteration. This does not free the GEM object's memory but drops all dma_fence references improperly, potentially leading to a denial of service condition due to the infinite loop. There is no indication of memory corruption or privilege escalation from the provided data.

A fix has been implemented in the Linux kernel to address this issue by deferring the dropping of fence references until after the RCU grace period. Users should apply the official kernel updates that include this patch to remediate the vulnerability. Since this is a kernel-level fix, upgrading to the patched kernel version is the recommended mitigation.