The Linux kernel vulnerability CVE-2026-46309 involves improper handling of the PAT index with XE_COH_NONE coherency mode in the drm/xe/uapi subsystem's madvise ioctl. Specifically, the kernel did not reject PAT indices with XE_COH_NONE when applied to CPU cached memory, which is a security issue. This allowed the GPU to bypass CPU caches and read stale data directly from DRAM, potentially leaking sensitive information from previously freed pages of other processes. The fix adds validation in xe_vm_madvise_ioctl() to reject such PAT indices, aligning with existing validation in the vm_bind path. The vulnerability affects multiple Linux kernel versions prior to 7.0.0-28.28 and related builds. The patch is included in updated Linux kernel packages distributed by Ubuntu.

Exploitation of this vulnerability could lead to unauthorized disclosure of sensitive data by allowing a GPU to read stale data from DRAM that should have been cleared, potentially leaking information from other processes. The CVSS score of 7.0 indicates a high impact on confidentiality, integrity, and availability, though the attack vector requires local access with low privileges and high attack complexity.

A patch is available and should be applied by updating to the fixed Linux kernel versions as provided by the vendor (Ubuntu). After updating, a system reboot is required to apply the changes. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be necessary. Follow the vendor advisory instructions for updating to the specified package versions to mitigate this vulnerability.