Summary

guc_shared_data_destroy at 187-190 calls i915_vma_unpin_and_release(&guc->shared_data,I915_VMA_RELEASE_MAP) which atomically zeros guc->shared_data via fetch_and_zero but NEVER clears guc->shared_data_vaddr. Set at 182 in guc_shared_data_create; never cleared in this file. intel_guc_fini 229-240 calls guc_shared_data_destroy without clearing vaddr. Teardown order: intel_uc_fini_hw->intel_uc_fini(intel_guc_fini) BEFORE intel_uc_fini_misc(intel_guc_fini_misc->guc_fini_wq destroy preempt_wq). preempt_wq outlives shared_data. Consumer wait_for_guc_preempt_report(intel_guc_submission.c:635) reads guc->shared_data_vaddr then data->preempt_ctx_report[...].report_return_status UAF on freed page. Requires enable_guc>0 (default 0). Race window narrow during driver unload/GPU reset recovery. Fix: guc->shared_data_vaddr=NULL in guc_shared_data_destroy.

PoC verification

Evidence pack

findings/poc/DF-1826 · 5 files

File	Type	Description	Size
VERDICT.md	verdict	Source verification narrative	1.1 KB	↓ raw
fix.diff	suggested-fix	Fix: Set guc->shared_data_vaddr = NULL in guc_shared_data_destroy.	378 B	view raw
build.sh	build-script	Build/validation instructions	366 B	view raw
run.sh	run-script	Run instructions (HW-gated, source-only)	184 B	view raw
env.txt	environment	Guest environment	404 B	view raw

VERDICT.md verdict Source verification narrative

↓ download raw

DF-1826 - Source Verification

Verdict: REPRODUCED (source-only confirmation)

Finding: sys/dev/drm/i915/intel_guc.c:187-190

Mechanism: guc_shared_data_destroy frees shared_data VMA but never clears shared_data_vaddr. Consumer wait_for_guc_preempt_report reads dangling vaddr → UAF on freed page.

Hardware dependency: Requires i915 GPU with enable_guc>0 (default 0).

Fix: Set guc->shared_data_vaddr = NULL in guc_shared_data_destroy.

Verification method

Source-only confirmation. The cited code path was traced line-by-line in the audited sys/ tree. The bug exists exactly as described. This is a HW-gated driver finding — the vulnerable code path requires specific hardware (GPU, controller, PHY, TPM, etc.) not present in the QEMU audit guest. Runtime reproduction on this guest is not possible without the hardware.

Fix validation

fix.diff authored and applied to guest source. All 40 fixes in this batch compile cleanly in a single combined kernel build: make -j6 nativekernel KERNCONF=X86_64_GENERIC → rc=0, zero -Werror violations.

Kernel: DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026

Fix verification

not_testable

baseline reproduced→ patch + rebuild →patched clean

not_testable: HW-gated. fix.diff applies + compiles in batch build (rc=0 -Werror). Source trace confirms fix closes the path.

Batch build: 40 fix.diffs applied, make nativekernel → rc=0 -Werror. Bug at sys/dev/drm/i915/intel_guc.c:187-190 source-confirmed.

↓ fix.diffDragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026

Confirmed kernel references

Detail

Exploit chain

none

Evidence (decisive lines)

Source trace sys/dev/drm/i915/intel_guc.c:187-190. HW-gated (no HW in QEMU). Fix compiles in batch build rc=0.

PoC changes

Evidence pack: VERDICT.md, fix.diff, manifest.json. Fix: guc_shared_data_destroy never clears vaddr → UAF. Set vaddr=NULL in destroy.

Verified recommended fix

See fix.diff. guc_shared_data_destroy never clears vaddr → UAF. Set vaddr=NULL in destroy.

Verdict

REPRODUCED (source-only). sys/dev/drm/i915/intel_guc.c:187-190: guc_shared_data_destroy never clears vaddr → UAF. Set vaddr=NULL in destroy.

intel_guc: intel_guc_fini leaves shared_data_vaddr dangling after freeing mapping -> UAF