Linux Kernel Vulnerability in Xe Device Management

CVE-2026-98391

What is CVE-2026-98391?

This vulnerability in the Linux kernel affects the Xe device management during virtual machine (VM) teardown. When a VM is terminated, the runtime power management (PM) reference is dropped asynchronously, allowing the device to enter an autosuspend state. Meanwhile, any queued page faults from the terminated VM can result in attempts to access the device when it is already suspended, triggering assertions and potentially leading to system instability. The issue arises from stale page faults that remain active even after the VM has been taken down, necessitating careful handling of PM references to ensure stability during operations that involve VM management.

References