CVE-2026-68264 (GCVE-0-2026-68264)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:01 – Updated: 2026-08-17 05:01
VLAI
Title
drm/xe/pt: Reset current_op in xe_pt_update_ops_init()
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() xe_pt_update_ops_init() fails to reset current_op to 0. On the vm_bind path, ops_execute() calls xe_pt_update_ops_prepare() inside the xe_validation_guard() / drm_exec_until_all_locked() loop. When that loop retries due to lock contention or OOM eviction (drm_exec_retry_on_contention() / xe_validation_retry_on_oom()), xe_pt_update_ops_prepare() runs again on the same vops, and each call to bind_op_prepare() increments current_op without resetting it. After N retries current_op exceeds the array size allocated by xe_vma_ops_alloc(), causing an out-of-bounds write into SLUB-poisoned memory and a subsequent UAF crash in xe_migrate_update_pgtables_cpu() when reading the corrupted pt_op->bind. Also reset needs_svm_lock and needs_invalidation which are derived in the same prepare pass and would otherwise cause wrong migrate ops selection and redundant TLB invalidation on retry. Fix this by resetting current_op, needs_svm_lock and needs_invalidation in xe_pt_update_ops_init(). v2 (Matt): - Add details in commit message. - Add Fixes tag and Cc to stable@vger.kernel.org (cherry picked from commit 046045543e530605c441063535e7dca0075369a6)
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: e8babb280b5ef904df54b3a90e5a7e3a9600c4a9 , < be5c39730ab8f1dfe59983bf7d8e3705541d1fee (git)
Affected: e8babb280b5ef904df54b3a90e5a7e3a9600c4a9 , < 157b1e3384d7d37f59c0c2b2ff2af8f557db1daa (git)
Affected: e8babb280b5ef904df54b3a90e5a7e3a9600c4a9 , < 90e4fd331b980259c40118d05b89b0ec514e7c48 (git)
Affected: e8babb280b5ef904df54b3a90e5a7e3a9600c4a9 , < 6384271ac1ac0099198d15df79212a19ebdb929d (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.12
Unaffected: 0 , < 6.12 (semver)
Unaffected: 6.12.103 , ≤ 6.12.* (semver)
Unaffected: 6.18.44 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_pt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "be5c39730ab8f1dfe59983bf7d8e3705541d1fee",
              "status": "affected",
              "version": "e8babb280b5ef904df54b3a90e5a7e3a9600c4a9",
              "versionType": "git"
            },
            {
              "lessThan": "157b1e3384d7d37f59c0c2b2ff2af8f557db1daa",
              "status": "affected",
              "version": "e8babb280b5ef904df54b3a90e5a7e3a9600c4a9",
              "versionType": "git"
            },
            {
              "lessThan": "90e4fd331b980259c40118d05b89b0ec514e7c48",
              "status": "affected",
              "version": "e8babb280b5ef904df54b3a90e5a7e3a9600c4a9",
              "versionType": "git"
            },
            {
              "lessThan": "6384271ac1ac0099198d15df79212a19ebdb929d",
              "status": "affected",
              "version": "e8babb280b5ef904df54b3a90e5a7e3a9600c4a9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_pt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/pt: Reset current_op in xe_pt_update_ops_init()\n\nxe_pt_update_ops_init() fails to reset current_op to 0. On the\nvm_bind path, ops_execute() calls xe_pt_update_ops_prepare() inside\nthe xe_validation_guard() / drm_exec_until_all_locked() loop. When\nthat loop retries due to lock contention or OOM eviction\n(drm_exec_retry_on_contention() / xe_validation_retry_on_oom()),\nxe_pt_update_ops_prepare() runs again on the same vops, and each\ncall to bind_op_prepare() increments current_op without resetting it.\n\nAfter N retries current_op exceeds the array size allocated by\nxe_vma_ops_alloc(), causing an out-of-bounds write into\nSLUB-poisoned memory and a subsequent UAF crash in\nxe_migrate_update_pgtables_cpu() when reading the corrupted pt_op-\u003ebind.\n\nAlso reset needs_svm_lock and needs_invalidation which are derived in\nthe same prepare pass and would otherwise cause wrong migrate ops\nselection and redundant TLB invalidation on retry.\n\nFix this by resetting current_op, needs_svm_lock and needs_invalidation\nin xe_pt_update_ops_init().\n\nv2 (Matt):\n   - Add details in commit message.\n   - Add Fixes tag and Cc to stable@vger.kernel.org\n\n(cherry picked from commit 046045543e530605c441063535e7dca0075369a6)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached through the DRM_IOCTL_XE_VM_BIND ioctl on an Intel Xe DRM render node (/dev/dri/renderD*), which requires local access to the device file; there is no remote or adjacent-network path.\nAC:L - The overflow needs only one retry of the xe_validation_guard()/drm_exec_until_all_locked() loop, and the attacker drives both retry sources itself: concurrent vm_bind/exec threads on the same BOs force drm_exec_retry_on_contention(), and filling VRAM forces xe_validation_retry_on_oom(). Both sides of the race are attacker-controlled and the sequence is repeatable at will.\nPR:L - Only an open file descriptor on the Xe render node plus a VM created via DRM_IOCTL_XE_VM_CREATE is needed; no capability check exists on the vm_bind path. Render nodes are routinely accessible to unprivileged users, Android apps, containers and GPU-sharing tenants.\nUI:N - The attacker performs the entire sequence (vm create, bo create, vm_bind with induced contention/memory pressure) from its own process; no victim action is required.\nS:U - The out-of-bounds write and the subsequent corrupted-pointer use occur in kernel heap memory within the same security authority as the kernel itself; no VM, IOMMU or sandbox boundary is crossed by the flaw itself.\nC:H - After the index inflates, xe_pt_update_ops_fini()/xe_pt_update_ops_abort() iterate i \u003c current_op and read adjacent-slab contents as xe_vma/pt pointers and num_entries, and xe_migrate_update_pgtables_cpu() consumes the corrupted pt_op, giving out-of-bounds reads of kernel objects and a UAF that can be groomed into an arbitrary-read primitive.\nI:H - Each retry writes a full struct xe_vm_pgtable_update_op (pointer-rich entries[] plus vma pointer and flags) past the end of the kmalloc\u0027d ops array, with attacker-chosen overflow length and slab size, and the corrupted entries are later fed to xe_pt_free_bind()/xe_pt_abort_bind() and GPU page-table programming \u2014 a controllable heap corruption suitable for privilege escalation.\nA:H - The commit documents an out-of-bounds write into SLUB-poisoned memory followed by a UAF crash in xe_migrate_update_pgtables_cpu(); an unprivileged process can reliably and repeatedly panic the kernel, and corrupted page-table state additionally wedges the GPU."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:01:56.847Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/be5c39730ab8f1dfe59983bf7d8e3705541d1fee"
        },
        {
          "url": "https://git.kernel.org/stable/c/157b1e3384d7d37f59c0c2b2ff2af8f557db1daa"
        },
        {
          "url": "https://git.kernel.org/stable/c/90e4fd331b980259c40118d05b89b0ec514e7c48"
        },
        {
          "url": "https://git.kernel.org/stable/c/6384271ac1ac0099198d15df79212a19ebdb929d"
        }
      ],
      "title": "drm/xe/pt: Reset current_op in xe_pt_update_ops_init()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68264",
    "datePublished": "2026-08-10T12:01:38.686Z",
    "dateReserved": "2026-07-30T09:28:09.378Z",
    "dateUpdated": "2026-08-17T05:01:56.847Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68264",
      "date": "2026-09-22",
      "epss": "0.00138",
      "percentile": "0.03553"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/xe/xe_pt.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "be5c39730ab8f1dfe59983bf7d8e3705541d1fee",
                    "status": "affected",
                    "version": "e8babb280b5ef904df54b3a90e5a7e3a9600c4a9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "157b1e3384d7d37f59c0c2b2ff2af8f557db1daa",
                    "status": "affected",
                    "version": "e8babb280b5ef904df54b3a90e5a7e3a9600c4a9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "90e4fd331b980259c40118d05b89b0ec514e7c48",
                    "status": "affected",
                    "version": "e8babb280b5ef904df54b3a90e5a7e3a9600c4a9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6384271ac1ac0099198d15df79212a19ebdb929d",
                    "status": "affected",
                    "version": "e8babb280b5ef904df54b3a90e5a7e3a9600c4a9",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/xe/xe_pt.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.12"
                  },
                  {
                    "lessThan": "6.12",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.103",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.44",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/pt: Reset current_op in xe_pt_update_ops_init()\n\nxe_pt_update_ops_init() fails to reset current_op to 0. On the\nvm_bind path, ops_execute() calls xe_pt_update_ops_prepare() inside\nthe xe_validation_guard() / drm_exec_until_all_locked() loop. When\nthat loop retries due to lock contention or OOM eviction\n(drm_exec_retry_on_contention() / xe_validation_retry_on_oom()),\nxe_pt_update_ops_prepare() runs again on the same vops, and each\ncall to bind_op_prepare() increments current_op without resetting it.\n\nAfter N retries current_op exceeds the array size allocated by\nxe_vma_ops_alloc(), causing an out-of-bounds write into\nSLUB-poisoned memory and a subsequent UAF crash in\nxe_migrate_update_pgtables_cpu() when reading the corrupted pt_op-\u003ebind.\n\nAlso reset needs_svm_lock and needs_invalidation which are derived in\nthe same prepare pass and would otherwise cause wrong migrate ops\nselection and redundant TLB invalidation on retry.\n\nFix this by resetting current_op, needs_svm_lock and needs_invalidation\nin xe_pt_update_ops_init().\n\nv2 (Matt):\n   - Add details in commit message.\n   - Add Fixes tag and Cc to stable@vger.kernel.org\n\n(cherry picked from commit 046045543e530605c441063535e7dca0075369a6)"
          }
        ],
        "id": "CVE-2026-68264",
        "lastModified": "2026-08-17T05:18:28.860",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-10T13:20:15.257",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/157b1e3384d7d37f59c0c2b2ff2af8f557db1daa"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6384271ac1ac0099198d15df79212a19ebdb929d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/90e4fd331b980259c40118d05b89b0ec514e7c48"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/be5c39730ab8f1dfe59983bf7d8e3705541d1fee"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-15T11:25:55+00:00",
      "cve": "CVE-2026-68264",
      "id": "CVE-2026-68264",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:fixed": "612",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/xe/pt: Reset current_op in xe_pt_update_ops_init()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68264.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-19T01:51:04Z",
      "cve": "CVE-2026-68264",
      "id": "CVE-2026-68264",
      "initial_release_date": "2026-08-14T17:15:03Z",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "298",
      "product_status:recommended": "83",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68264",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68264.json",
      "version": "6"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.