In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Unmask interrupts only when ACTIVE is true There is a small race… (CVE-2026-99005)

The vulnerability in the Linux kernel's i915 DRM driver arises from a race condition between asynchronous wakeref drop callbacks and the intel_rps_boost() function reading a stale ACTIVE state. This race can cause rps_work() to execute after the GPU (GT) has been parked, leading to unmasking of RPS power management interrupts without holding the necessary runtime PM wakelock. This results in a kernel taint triggered by an assertion failure detecting hardware access without the wakelock. The issue was introduced by a commit that removed a guard around unmasking interrupts. The fix involves skipping the unmask operation when the RPS is no longer active, preventing unmasking during parked states while allowing normal RPS operation to resume on the next unpark event.

If exploited, this race condition can cause the kernel to perform hardware MMIO writes without holding the required runtime power management wakelock, leading to kernel taint. While this does not directly cause memory corruption or privilege escalation, it indicates improper synchronization that may affect system stability or reliability.

A fix has been applied in the Linux kernel to ensure interrupts are only unmasked when the RPS is active, preventing the race condition. Users should update to a kernel version that includes the commit cherry-picked as ca4a6deadad15b91ee083afe445fa6bdbfb68206 or later. No additional mitigation is required as the fix addresses the root cause.