VERDICT — DF-3945

Bottom line

not_reproduced on the audit guest (no Intel Gen9 GPU; virtio-gpu only) — carriage of CVE-2019-14615 is certain by source equivalence.

Proof of carriage

1. Upstream stable history (github gregkh/linux, path drivers/gpu/drm/i915/intel_lrc.c, linux-4.19.y): the newest post-2018 commit touching this file is dd4f3b3508f6 (2020-01-14), the backport of bc8a76a152c5 fixing CVE-2019-14615. Its full 9-line patch adds a WaClearSlmSpaceAtContextSwitch:skl,bxt,kbl,glk,cfl pipe control to gen9_init_indirectctx_bb between gen8_emit_flush_coherentl3_wa() and emit_lri(). Fetched and diffed against this tree: - intel_lrc.c:1581 batch = gen8_emit_flush_coherentl3_wa(engine, batch); - intel_lrc.c:1583 batch = emit_lri(batch, lri, ARRAY_SIZE(lri)); — nothing in between. The patch's exact insertion context matches our file (the 4.19.y patch hunk pre-context "WaFlushCoherentL3CacheLinesAtContextSwitch:skl,bxt,glk" is at our :1580).
2. Our snapshot otherwise includes everything else from that stable history: the Nov 2018 write-serialisation mb() (0a823e8fd4fd) and the Dec 2018 Braswell full-mb (cf66b8a0ba14) are both present verbatim in execlists_update_context() (intel_lrc.c:440-456). So the CVE fix is the one carried gap, not a wholesale version skew.
3. Gen8's cleardown exists in-tree (intel_lrc.c:1509-1517), matching the upstream commit message ("this workaround is already in place for gen8"); Gen9's is absent, and the only Gen9 pipe control resembling it is A0-stepping-gated (intel_lrc.c:1587 IS_KBL_REVID(..., 0, KBL_REVID_A0)), which does not cover production SKL/KBL/BXT/GLK/CFL steppings.

Impact

Cross-context GPU info disclosure on Intel Gen9 (SKL/KBL/BXT/GLK/CFL) when two security domains share the GPU (multi-user machine, containers, or unprivileged user vs setuid GPU consumer). Intel PSIRT-TA-201910-001 / CVE-2019-14615, NVD Medium. Confidentiality-only, local, requires Gen9 hardware — hardware-gated for this audit guest (env.txt: no /dev/dri, virtio-gpu 1af4:1100).

Hunt-list cross-check (intel_lrc.c pass 2)

• (a) context pin/unpin lifetimes: execlists_context_pin/unpin/destroy (:1288-1414) balanced; ce->state NULL-guard present (upstream "Check for ce->state before destroy" carried, :1292); request holds hw_context ref through execlists_reset (:1983).
• (b) priolist RB walks: lookup_priolist/__unwind_incomplete_requests/ execlists_schedule DFS match upstream 4.19-rc; alloc-failure→priority-bump (:293-308) and default_priolist embedding are stock.
• (c) LRI emission: all ring_begin() sizes match emitted dword counts (emit_pdps 18/18, bb_start 6/6, flush 4/4, flush_render len-exact, breadcrumbs 6+2 and 8+2); emit_lri count ≤63 guarded (:1541).
• (d) wa-tail/tail writebacks: unwind_wa_tail/gen8_emit_wa_tail wrap via intel_ring_wrap (:319-323, :2233-2239) — the "Wrap around the tail offset" stable fix is carried.
• (e) upstream CVEs: 0a823e8fd4fd and cf66b8a0ba14 carried (mb() at :455); CVE-2019-14615 NOT carried → this finding. No other intel_lrc.c CVEs exist in the 4.19.y history (checked the full per-path commit list).

Fix validation

Not possible on this guest (no Gen9 GPU): fix_status=not_testable. fix.diff is the upstream fix adapted to this tree's i915_scratch_offset() API, git apply --check clean.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.