CVE-2026-68265

Received Received - Intake

DRM/XE BO Prefetch Out-of-Bounds Access in Linux Kernel

Publication date: 2026-08-10

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOC When prefetch region is DRM_XE_CONSULT_MEM_ADVISE_PREF_LOC for a BO VMA, the code used it as an index into region_to_mem_type[], causing an out-of-bounds access since the value is -1. Resolve the preferred location for BO VMAs directly: local VRAM on dGFX (using the BO's tile placement) or system memory on iGPU. Discovered using AI-assisted static analysis confirmed by Intel Product Security. v2: -Fix null dereference (cherry picked from commit d9a4906ac03be9f6ed3f3b45c56c866b867fd75b)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-17

Generated

2026-08-30

AI Q&A

2026-08-10

EPSS Evaluated

2026-08-29

NVD

CVE-2026-68265

EUVD

EUVD-2026-55366

Affected Vendors & Products

Vendor	Product	Version / Range
intel	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where incorrect handling of memory prefetch regions for GPU buffer objects (BOs) leads to an out-of-bounds array access. The code mistakenly uses a value of -1 as an index into region_to_mem_type[], causing memory corruption or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's DRM/XE subsystem and requires kernel-level inspection. Detection involves checking kernel logs for out-of-bounds access errors or null dereferences related to BO VMA prefetching. Use commands like dmesg | grep -i xe or journalctl -k | grep -i xe to search for errors. If you suspect exploitation, monitor for crashes in graphics-related processes or unusual memory access patterns.

Impact Analysis

This flaw could cause system instability, crashes, or potential privilege escalation if exploited. Users running affected Linux kernels with Intel integrated or discrete GPUs may experience graphical issues or system failures.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a memory access issue in the Linux kernel's DRM/XE driver that could lead to system instability or crashes but does not involve data exposure or privacy violations typical of compliance concerns.

Mitigation Strategies

Immediately update your Linux kernel to the latest patched version provided by your distribution. If an update is unavailable, apply the kernel patch from commit d9a4906ac03be9f6ed3f3b45c56c866b867fd75b. Disable graphics-related services temporarily if the issue is suspected to be actively exploited. Monitor vendor advisories for further guidance.

Hi! I’m here to help you understand CVE-2026-68265. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70