CVE-2026-68264
Received Received - Intake

Buffer Overflow in Linux Kernel DRM/XE Driver

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() xe_pt_update_ops_init() fails to reset current_op to 0. On the vm_bind path, ops_execute() calls xe_pt_update_ops_prepare() inside the xe_validation_guard() / drm_exec_until_all_locked() loop. When that loop retries due to lock contention or OOM eviction (drm_exec_retry_on_contention() / xe_validation_retry_on_oom()), xe_pt_update_ops_prepare() runs again on the same vops, and each call to bind_op_prepare() increments current_op without resetting it. After N retries current_op exceeds the array size allocated by xe_vma_ops_alloc(), causing an out-of-bounds write into SLUB-poisoned memory and a subsequent UAF crash in xe_migrate_update_pgtables_cpu() when reading the corrupted pt_op->bind. Also reset needs_svm_lock and needs_invalidation which are derived in the same prepare pass and would otherwise cause wrong migrate ops selection and redundant TLB invalidation on retry. Fix this by resetting current_op, needs_svm_lock and needs_invalidation in xe_pt_update_ops_init(). v2 (Matt): - Add details in commit message. - Add Fixes tag and Cc to stable@vger.kernel.org (cherry picked from commit 046045543e530605c441063535e7dca0075369a6)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68264
EUVD
EUVD-2026-55365

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability in the DRM/XE driver where xe_pt_update_ops_init() fails to reset current_op to 0. During the vm_bind path, repeated retries due to lock contention or OOM eviction cause current_op to increment without reset, leading to an out-of-bounds write into SLUB-poisoned memory. This results in a use-after-free (UAF) crash when xe_migrate_update_pgtables_cpu() reads corrupted pt_op->bind.

Detection Guidance

This vulnerability is specific to the Linux kernel's DRM/Xe driver and may not have direct network detection methods. Monitor kernel logs for crashes or errors related to xe_migrate_update_pgtables_cpu or SLUB poisoning. Check for out-of-bounds write events in kernel logs.

Impact Analysis

This vulnerability can cause system crashes due to memory corruption, leading to potential denial-of-service conditions. If exploited, it may allow attackers to execute arbitrary code with kernel privileges, compromising system integrity and confidentiality.

Mitigation Strategies

Apply the kernel patch that resets current_op, needs_svm_lock, and needs_invalidation in xe_pt_update_ops_init(). Update to a Linux kernel version that includes the fix. If immediate patching is not possible, disable the affected DRM/Xe driver module if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68264. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart