Linus Torvalds has fixed a bug in the Linux Xe graphics driver that could cause a machine with an Intel Battlemage G21 GPU with 16 GB of VRAM to end up with the graphical session repeatedly restarting. The most interesting part is not just that the final fix came down to a rounding change, but how it was found: Torvalds used AI to instrument the kernel and analyse results, yet continued investigating after the model repeatedly concluded that the problem was impossible to solve. The official 818bebeb63dd6bf5f4e07e145f6cdbace520a34c commit was signed by Torvalds on August 20, 2026.
The Key Facts About This Linux Bug in 30 Seconds
- The problem was in Intel’s Xe graphics driver, not the older i915 driver.
- It affected a specific Intel Battlemage G21 configuration with 16 GB of VRAM.
- The investigation required 24 debugging patches and 18 kernel boots.
- The fix changes a
round_up()operation toround_down()so CCS memory is not exposed to the VRAM allocator. - AI helped with instrumentation, analysis and the commit message, but Torvalds rejected its conclusion that the bug could not be solved.
The Error Was in How Linux Calculated Available VRAM
The story also requires an important correction to some versions of the bug report circulating online. The affected code belongs to Intel’s Xe driver, in drivers/gpu/drm/xe/xe_vram.c. It was not an i915 bug and the affected file was not i915_flat_ccs.c.
The problem was located in get_flat_ccs_offset(), a function that calculates where Flat CCS storage begins. CCS is associated with Intel GPU memory compression. The calculation obtains an address from hardware registers, adjusts it according to the number of enabled L3 nodes and then uses the resulting value to determine which portion of VRAM can be handed to the memory allocator.
The problematic code used round_up(offset, SZ_128K). In other words, it rounded the calculated boundary upward to a 128 KiB alignment.
That becomes significant when the calculated address is being used as a boundary between memory that can be allocated and memory reserved for CCS. Rounding upward can move the boundary into an area that still belongs to the compression storage.
The official commit documents a specific example involving a 16 GiB Battlemage G21. The actual address was 0x3fafff800, while rounding it upward produced 0x3fb000000. That meant the final 2 KiB of a page inside the CCS area could incorrectly be included in the memory made available to the VRAM allocator.
The result was a subtle overlap between two different uses of GPU memory. The allocator could regard part of the region as available while the compression hardware continued to use it.
That helps explain why the problem was so difficult to track down. There was no simple invalid pointer or obvious kernel panic. Instead, structures used by the GPU could become corrupted, eventually causing the graphical environment to fail and the display manager to restart.
24 Patches, 18 Boots and an AI That Wanted to Give Up
The most unusual part of the investigation appears in Torvalds’ own commit message. He explains that the debugging process required 24 debugging patches and 18 separate kernel boots before the problem was isolated. AI was used during that process and handled much of the instrumentation and analysis work.
But the model repeatedly reached the conclusion that the bug was impossible or effectively unsolvable. Torvalds continued anyway.
According to the commit, the AI kept generating debugging code and analysing additional results when prompted to continue. Eventually, Torvalds credited it with enough of the work that he also allowed it to write the final commit message.
That distinction is more useful than simply saying that Linus Torvalds used AI.
The model was capable of generating technical work, adding instrumentation, analysing output and suggesting the next debugging steps. It was not, however, treated as the final authority on whether the problem had a solution.
The episode illustrates a practical limitation of AI-assisted software engineering: a model can reach a confident negative conclusion without that conclusion being proof that no solution exists. In low-level debugging, experimental evidence from the actual hardware and code remains decisive.
The Final Fix Was Small, But the Diagnosis Wasn’t
The final patch changes the calculation so that the boundary is rounded down to a 4 KiB page rather than upward to a 128 KiB boundary.
Conceptually, the change is:
Before:
offset = round_up(offset, SZ_128K);
After:
offset = round_down(offset, SZ_4K);The important detail is what that value represents. Everything below the calculated offset is handed to the VRAM allocator. The boundary therefore has to remain on the safe side of the CCS region rather than being pushed upward into memory that is still reserved for compression.
The patch also changes an existing check that was supposed to detect an incorrect separation between the memory regions. The previous condition did not properly identify the problematic situation, so the new code changes the comparison to detect the actual misalignment.
This is a good example of why the size of a final patch tells little about the difficulty of finding it. The eventual change is tiny. The investigation required repeated kernel rebuilds, additional instrumentation, hardware testing and analysis of increasingly specific observations.
A Xe Driver Bug, Not a Linux Security Vulnerability
Another point deserves some caution. The official commit does not describe this as a security vulnerability or an exploit. It is a graphics-driver bug involving the handling of memory reserved for compression and memory made available to the GPU’s VRAM allocator.
Memory-management errors can certainly have security implications in other circumstances, but there is no basis in this commit alone for describing this particular issue as an exploitable privilege-escalation or code-injection vulnerability.
The fix also follows the normal Linux kernel maintenance process. The commit includes a Fixes tag pointing back to the change that introduced the problematic calculation and a Cc: [email protected] tag requesting consideration for affected stable kernel branches.
The Linux kernel documentation explains that stable branches receive appropriate fixes for problems discovered after a kernel release.
The more useful lesson from this episode is therefore not simply that AI got something wrong. A model can participate in a highly complex kernel investigation and remove a large amount of repetitive work. But a confident model output remains a hypothesis that has to be tested against the code, the hardware and reproducible evidence.
In this case, the upstream Linux record preserves the whole process: 24 debugging patches, 18 kernel boots, a specific memory address that exposed the overlap and, finally, a small change that corrected the boundary between usable VRAM and CCS storage.