{"id":"CVE-2026-99005","kind":"vulnerability","aliases":["CVE-2026-99005"],"related":[],"title":"Linux i915 GPU driver: late worker unmasks interrupts while GPU is parked","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gt: Unmask interrupts only when ACTIVE is true\n\nThere is a small race window between intel_rps_boost() reading\na stale ACTIVE state and queuing rps->work, where ACTIVE may be\nchanged via asynchronous calls triggered by wakeref drop.\nThis means that rps_work() could be triggered after the GT has\nbeen parked, so unmasking RPS PM interrupts would happen without\nholding PM wakelock. This sequence of events may be observed\nduring live_rc6_ctx_wa() selftest:\n\n1) live_rc6_ctx_wa()\n   -> intel_engine_pm_put()\n      -> wakeref_put()\n\nASYNC1) wakeref_put() callback\n          -> __engine_park()\n             -> intel_gt_pm_put_async()\n                -> intel_gt_pm_put_async_untracked()\n                   -> intel_wakeref_put_async()\n\nASYNC2) wakeref_put_async() callback\n          -> __gt_park()\n             -> intel_rps_park()\n                -> intel_rps_clear_active() [clear ACTIVE]\n                WITH INTERRUPTS:\n                -> rps_disable_interrupts()\n                   -> cancel_work_sync(rps->work)\n                   -> rps_reset_interrupts() [rps->pm_iir = 0]\n                WITHOUT INTERRUPTS (TIMER mode):\n                -> rps_stop_timer()\n                   -> cancel_work_sync(rps->work)\n\n2) live_rc6_ctx_wa()\n   -> intel_gt_wait_for_idle()\n      -> intel_gt_retire_requests_timeout()\n         -> dma_fence_wait_timeout()\n            -> ops->wait() [i915_fence_wait()]\n               -> i915_request_wait_timeout()\n                  -> intel_rps_boost()\n                     -> intel_rps_is_active() [check ACTIVE]\n                        [OPEN RACE WINDOW]\n                     -> queue_work(rps->work)\n         -> retire_requests()\n            -> i915_request_retire()\n               -> intel_rps_dec_waiters() [from 1 to 0]\n\nIf ASYNC1 and ASYNC2 would execute during [OPEN RACE WINDOW],\nthen:\n\n3) rps_work() executes from the workqueue and may satisfy\n   \"(!pm_iir && !client_boost)\" test (in TIMER mode rps->pm_iir\n   is zeroed by an earlier rps_work() call or never gets a new\n   value after previous intel_rps_unpark() event), so it jumps\n   to \"out\" label, bypassing intel_rps_is_active() guard and\n   executes gen6_gt_pm_unmask_irq();\n\n4) GT is parked and runtime PM wakelock is dropped, so only\n   a raw reference in __gt_park() ->\n   intel_display_power_put_async() remains for 100ms, then the\n   MMIO write in gen6_gt_pm_unmask_irq() detects missing\n   wakelock via assert_rpm_wakelock_held() and emits\n   \"RPM wakelock ref not held during HW access\" tainting kernel.\n\nCommit 3e7abf814193 (\"drm/i915: Extract GT render power state management\")\ndropped the \"if (rps->interrupts_enabled)\" guard that\ngen6_pm_rps_work() had around this unmask in i915_irq.c.\nINTEL_RPS_ACTIVE brackets the same window, since it is set in\nintel_rps_unpark() before rps_enable_interrupts() and\nrps_start_timer() and cleared in intel_rps_park() before\nrps_stop_timer() and rps_disable_interrupts().\n\nSkip unmasking when RPS is no longer active (reaching unmask\noperation is independent of INTERRUPT mode). This does not\nprevent RPS operation from resuming on the next unpark.\nIn interrupt mode, intel_rps_unpark() calls\nrps_enable_interrupts(), which enables and unmasks the PM\ninterrupts. In timer mode, it calls rps_start_timer(),\nrestarting periodic engine-busyness evaluation. The timer\ngenerates software RPS events and queues rps_work() directly,\nindependently of PM interrupt delivery. Neither mode requires\nthe late worker to unmask interrupts while the GT is parked\n\n(cherry picked from commit ca4a6deadad15b91ee083afe445fa6bdbfb68206)","summary":"A race in the Intel i915 graphics driver can run a power-management worker after the GPU has gone idle, unmasking interrupts without the runtime power reference held. The result is a kernel warning and taint, and the sources describe no attacker-controlled effect.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["i915","intel-graphics","linux-kernel","package"],"not_affected_if":["i915-not-loaded","no-intel-gpu"],"how_to_check":"- Check the running kernel version with `uname -r` and compare it against the fixed stable release listed in the NVD record.\n- Check whether the i915 driver is loaded with `lsmod | grep i915`.\n- Check the kernel log for the message \"RPM wakelock ref not held during HW access\" with `dmesg | grep 'RPM wakelock'`.","fix":"- Update the Linux kernel to a stable release that includes upstream commit ca4a6deadad15b91ee083afe445fa6bdbfb68206 (the sources do not list the exact version).","status":"open","published_at":"2026-10-23T13:17:22+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:55:54+00:00","updated_at":"2026-10-25T04:55:54+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:55:54Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a stable release that includes upstream commit ca4a6deadad15b91ee083afe445fa6bdbfb68206 (the sources do not list the exact version).","reach":"local","title":"Linux i915 GPU driver: late worker unmasks interrupts while GPU is parked","impact":"low","summary":"A race in the Intel i915 graphics driver can run a power-management worker after the GPU has gone idle, unmasking interrupts without the runtime power reference held. The result is a kernel warning and taint, and the sources describe no attacker-controlled effect.","category":"package","nicknames":[],"who_cares":["linux-kernel","intel-graphics","i915"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; the sources describe a kernel warning and taint, not code execution","analyst_note":"","how_to_check":"- Check the running kernel version with `uname -r` and compare it against the fixed stable release listed in the NVD record.\n- Check whether the i915 driver is loaded with `lsmod | grep i915`.\n- Check the kernel log for the message \"RPM wakelock ref not held during HW access\" with `dmesg | grep 'RPM wakelock'`.","needs_analyst":false,"not_affected_if":["no-intel-gpu","i915-not-loaded"],"who_is_affected":"Systems running a Linux kernel with the Intel i915 graphics driver, typically desktops and laptops with Intel integrated graphics. Systems without Intel graphics, or with the i915 driver not loaded, are not affected by this flaw.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000768,"input_tokens":4733,"output_tokens":589,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-99005':15A,18A '0':224C,293C '1':160C,291C '100ms':390C '2':237C '3':305C '3e7':422C '4':365C 'abf814193':423C 'access':418C 'activ':88C,104C,111C,205C,207C,271C,273C,356C,452C,494C 'around':444C 'assert':405C 'async':181C,186C,191C,195C,387C 'async1':171C,295C 'async2':192C,297C 'asynchron':116C 'attack':70B 'attacker-control':69B 'boost':100C,267C,318C 'bracket':453C 'busy':544C 'bypass':352C 'ca4a6deadad15b91ee083afe445fa6bdbfb68206':580C 'call':117C,333C,521C,536C 'callback':174C,196C 'cancel':213C,232C 'chang':114C 'check':272C 'cherri':576C 'clear':204C,206C,474C 'client':317C 'commit':421C,579C 'control':71B 'could':127C 'ctx':157C,163C,240C 'cve':13A,16A 'dec':288C 'deliveri':561C 'describ':67B 'detect':401C 'direct':556C 'disabl':211C,485C 'display':384C 'dma':252C 'driver':4A,34B 'drm/i915':424C 'drm/i915/gt':83C 'drop':121C,374C,431C 'earlier':330C 'effect':72B 'emit':410C 'enabl':436C,467C,523C,526C 'engin':166C,175C,543C 'engine-busy':542C 'evalu':545C 'event':150C,345C,551C 'execut':299C,308C,359C 'extract':425C 'fenc':253C,259C 'follow':78C 'gen6':360C,396C,439C 'generat':548C 'get':336C 'gone':46B 'gpu':3A,10A,44B 'graphic':22B,33B 'gt':132C,178C,183C,197C,243C,248C,361C,366C,381C,397C,426C,573C 'guard':357C,437C 'happen':142C 'held':55B,408C,415C 'hold':144C 'hw':417C 'i915':2A,19B,32B,258C,261C,283C,448C 'idl':47B,246C 'iir':223C,316C,325C 'independ':499C,557C 'intel':21B,31B,98C,165C,177C,182C,188C,199C,202C,242C,247C,265C,268C,286C,342C,353C,383C,450C,462C,476C,518C 'intel-graph':20B 'interrupt':8A,49B,85C,140C,209C,212C,220C,226C,435C,468C,486C,501C,516C,524C,531C,560C,570C 'irq':364C,400C 'irq.c':449C 'jump':348C 'kernel':25B,60B,76C,420C 'label':351C 'late':5A,566C 'linux':1A,24B,75C 'linux-kernel':23B 'live':155C,161C,238C 'longer':493C 'manag':40B,430C 'may':112C,151C,313C 'mean':123C 'miss':402C 'mmio':393C 'mode':228C,322C,502C,517C,534C,563C 'neither':562C 'never':335C 'new':338C 'next':513C 'observ':153C 'op':256C 'open':274C,301C 'oper':497C,508C 'packag':26B 'park':12A,135C,176C,198C,201C,368C,382C,478C,575C 'period':541C 'pick':577C 'pm':139C,145C,167C,179C,184C,222C,315C,324C,362C,371C,398C,440C,530C,559C 'power':39B,53B,385C,428C 'power-manag':38B 'prevent':506C 'previous':341C 'put':168C,170C,173C,180C,185C,190C,194C,386C 'queu':107C 'queue':277C,553C 'race':28B,95C,275C,302C 'raw':378C 'rc6':156C,162C,239C 'reach':495C 'read':101C 'ref':413C 'refer':54B,379C 'remain':388C 'render':427C 'request':250C,262C,282C,284C 'requir':564C 'reset':219C 'resolv':82C 'restart':540C 'result':57B 'resum':510C 'retir':249C,281C,285C 'rpm':406C,411C 'rps':99C,108C,125C,138C,200C,203C,210C,216C,218C,221C,229C,235C,266C,269C,279C,287C,306C,323C,331C,343C,354C,434C,441C,451C,463C,466C,470C,477C,480C,484C,490C,507C,519C,522C,537C,550C,554C 'run':36B 'runtim':52B,370C 'satisfi':314C 'selftest':159C 'sequenc':148C 'set':460C 'sinc':457C 'skip':487C 'small':94C 'softwar':549C 'sourc':66B 'stale':103C 'start':471C,538C 'state':105C,429C 'stop':230C,481C 'sync':215C,234C 'taint':63B,419C 'test':319C 'timeout':251C,255C,264C 'timer':227C,231C,321C,472C,482C,533C,539C,547C 'trigger':118C,129C 'true':90C 'unmask':7A,48B,84C,137C,363C,399C,446C,488C,496C,528C,569C 'unpark':344C,464C,514C,520C 'untrack':187C 'valu':339C 'via':115C,404C 'vulner':79C 'wa':158C,164C,241C 'wait':244C,254C,257C,260C,263C 'waiter':289C 'wakelock':146C,372C,403C,407C,412C 'wakeref':120C,169C,172C,189C,193C 'warn':61B 'window':96C,276C,303C,456C 'without':50B,143C,225C 'work':109C,126C,214C,217C,233C,236C,278C,280C,307C,332C,442C,555C 'worker':6A,41B,567C 'workqueu':311C 'would':141C,298C 'write':394C 'zero':327C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the Intel i915 graphics driver, typically desktops and laptops with Intel integrated graphics. Systems without Intel graphics, or with the i915 driver not loaded, are not affected by this flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:22+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99005","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99005","severity":null,"published_at":"2026-10-23T13:17:22+00:00","modified_at":"2026-10-23T13:17:22+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}