Linux i915 GPU kernel driver (context SSEU parameter): NULL dereference reachable by setting a context engine slot

Impact

NULL dereference reachable by setting a context engine slot to an invalid engine class and then querying the SSEU context parameter. A tenant can panic the GPU node from an ordinary unprivileged ioctl sequence.

Who can reach it

Any local user or container with a DRM render node - i.e. any tenant that was scheduled a GPU. No privileged capability needed.

What to do

Fix ships in the Linux kernel. Update the kernel and reboot the node - in practice this is a drain plus reboot because the accelerator driver cannot be unloaded while jobs hold device file descriptors. No BIOS or firmware update needed.

References