CVE-2026-68305 (GCVE-0-2026-68305)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:02 – Updated: 2026-08-17 05:02
VLAI
Title
drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers CCS read/write buffers are freed during BO destruction. In some cases, BOs may be destroyed after the device is unbound but while the DRM structure remains valid, leading to NULL pointer dereferences when accessing device resources. BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 0 UID: 0 PID: 9376 Comm: xe_pat Not tainted 7.2.0-rc2+ #1 PREEMPT(lazy) RIP: 0010:xe_sriov_vf_ccs_rw_update_bb_addr+0x4d/0xa0 [xe] RSP: 0018:ffffcf304110b9c8 EFLAGS: 00010246 RAX: ffff8a85c38a0a00 RBX: 00000000810ef000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8a85c39c1888 RBP: ffffcf304110b9e8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff8a85c39c1888 R13: 0000000000000000 R14: ffff8a85c39b4f28 R15: ffff8a85c3885000 FS: 0000000000000000(0000) GS:ffff8a878b809000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000010314a002 CR4: 0000000000772ef0 PKRU: 55555554 Call Trace: <TASK> xe_migrate_ccs_rw_copy_clear+0x98/0x120 [xe] xe_sriov_vf_ccs_detach_bo+0x2c/0x60 [xe] xe_ttm_bo_delete_mem_notify+0xc8/0xe0 [xe] ttm_bo_cleanup_memtype_use+0x26/0x80 [ttm] ttm_bo_release+0x29e/0x2d0 [ttm] ttm_bo_fini+0x39/0x70 [ttm] xe_gem_object_free+0x1f/0x30 [xe] drm_gem_object_free+0x1d/0x40 ttm_bo_vm_close+0x5f/0x90 [ttm] remove_vma+0x2c/0x70 tear_down_vmas+0x63/0xf0 exit_mmap+0x20d/0x3f0 __mmput+0x45/0x170 mmput+0x31/0x40 do_exit+0x2ba/0xac0 do_group_exit+0x2d/0xb0 __x64_sys_exit_group+0x18/0x20 x64_sys_call+0x14a0/0x2390 do_syscall_64+0xdd/0x640 ? count_memcg_events+0xea/0x240 ? handle_mm_fault+0x1ec/0x2f0 (cherry picked from commit 1ae415a6eefe5004954a1d352b1718faca8844ef)
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 864690cf4dd62482b6dd049d82c509886c904303 , < 523ed2831ee55b2a1edabdea96781651f9df9685 (git)
Affected: 864690cf4dd62482b6dd049d82c509886c904303 , < 4c92afb4c143526d340545ca581e88e6952ea511 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.18
Unaffected: 0 , < 6.18 (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_migrate.c",
            "drivers/gpu/drm/xe/xe_migrate.h",
            "drivers/gpu/drm/xe/xe_sriov_vf_ccs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "523ed2831ee55b2a1edabdea96781651f9df9685",
              "status": "affected",
              "version": "864690cf4dd62482b6dd049d82c509886c904303",
              "versionType": "git"
            },
            {
              "lessThan": "4c92afb4c143526d340545ca581e88e6952ea511",
              "status": "affected",
              "version": "864690cf4dd62482b6dd049d82c509886c904303",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_migrate.c",
            "drivers/gpu/drm/xe/xe_migrate.h",
            "drivers/gpu/drm/xe/xe_sriov_vf_ccs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers\n\nCCS read/write buffers are freed during BO destruction. In some cases,\nBOs may be destroyed after the device is unbound but while the DRM\nstructure remains valid, leading to NULL pointer dereferences when\naccessing device resources.\n\nBUG: kernel NULL pointer dereference, address: 0000000000000000\nPGD 0 P4D 0\nOops: Oops: 0000 [#1] SMP NOPTI\nCPU: 0 UID: 0 PID: 9376 Comm: xe_pat Not tainted 7.2.0-rc2+ #1 PREEMPT(lazy)\nRIP: 0010:xe_sriov_vf_ccs_rw_update_bb_addr+0x4d/0xa0 [xe]\nRSP: 0018:ffffcf304110b9c8 EFLAGS: 00010246\nRAX: ffff8a85c38a0a00 RBX: 00000000810ef000 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8a85c39c1888\nRBP: ffffcf304110b9e8 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: ffff8a85c39c1888\nR13: 0000000000000000 R14: ffff8a85c39b4f28 R15: ffff8a85c3885000\nFS:  0000000000000000(0000) GS:ffff8a878b809000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000000 CR3: 000000010314a002 CR4: 0000000000772ef0\nPKRU: 55555554\nCall Trace:\n \u003cTASK\u003e\n xe_migrate_ccs_rw_copy_clear+0x98/0x120 [xe]\n xe_sriov_vf_ccs_detach_bo+0x2c/0x60 [xe]\n xe_ttm_bo_delete_mem_notify+0xc8/0xe0 [xe]\n ttm_bo_cleanup_memtype_use+0x26/0x80 [ttm]\n ttm_bo_release+0x29e/0x2d0 [ttm]\n ttm_bo_fini+0x39/0x70 [ttm]\n xe_gem_object_free+0x1f/0x30 [xe]\n drm_gem_object_free+0x1d/0x40\n ttm_bo_vm_close+0x5f/0x90 [ttm]\n remove_vma+0x2c/0x70\n tear_down_vmas+0x63/0xf0\n exit_mmap+0x20d/0x3f0\n __mmput+0x45/0x170\n mmput+0x31/0x40\n do_exit+0x2ba/0xac0\n do_group_exit+0x2d/0xb0\n __x64_sys_exit_group+0x18/0x20\n x64_sys_call+0x14a0/0x2390\n do_syscall_64+0xdd/0x640\n ? count_memcg_events+0xea/0x240\n ? handle_mm_fault+0x1ec/0x2f0\n\n(cherry picked from commit 1ae415a6eefe5004954a1d352b1718faca8844ef)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The path is reached through the local DRM device (/dev/dri/renderD*) \u2014 GEM object creation/mmap and process teardown driving TTM BO destruction; no network or remote input is involved.\nAC:L - No race must be won: a local user only needs live CCS-attached BOs when the device is unbound/hot-removed, after which every subsequent BO release deterministically walks the stale pointers, and BO lifetime is fully under the user\u0027s control.\nPR:L - Only ordinary access to the render node is required to create and hold the CCS-attached buffer objects whose destruction triggers the fault; no capability check guards xe_sriov_vf_ccs_detach_bo().\nUI:N - The faulting code runs automatically from the BO release path (exit_mmap/ttm_bo_release) with no action by any other user; the unbind/hot-remove event is an administrative or host-side operation, not victim interaction.\nS:U - The freed objects and the resulting corruption all belong to the same kernel within the VF guest; no VM, IOMMU or sandbox boundary is crossed.\nC:H - After unbind, ctx-\u003emig_q, pool-\u003ebo/shadow and pool-\u003ecpu_addr are dangling devm-freed objects that are read (xe_mem_pool_swap_shadow_locked, xe_map_memcpy_to from pool-\u003ecpu_addr), so reallocated kernel memory can be read and its contents propagated, giving a use-after-free disclosure primitive.\nI:H - The same path writes through the stale mappings \u2014 memset(cs, MI_NOOP, bb-\u003esa_node.size), xe_map_wr into the freed LRC BO vmap and a memcpy into the freed shadow BO \u2014 so freed memory that may already be reused is overwritten, a use-after-free write primitive.\nA:H - The reported and reproducible outcome is a kernel NULL pointer dereference oops in xe_sriov_vf_ccs_rw_update_bb_addr() during process exit, killing the task in kernel context and destabilizing the machine."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:02:57.484Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/523ed2831ee55b2a1edabdea96781651f9df9685"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c92afb4c143526d340545ca581e88e6952ea511"
        }
      ],
      "title": "drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68305",
    "datePublished": "2026-08-10T12:02:39.911Z",
    "dateReserved": "2026-07-30T09:28:09.381Z",
    "dateUpdated": "2026-08-17T05:02:57.484Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68305",
      "date": "2026-08-26",
      "epss": "0.00129",
      "percentile": "0.02821"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-68305\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-10T13:20:20.193\",\"lastModified\":\"2026-08-17T05:18:33.373\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers\\n\\nCCS read/write buffers are freed during BO destruction. In some cases,\\nBOs may be destroyed after the device is unbound but while the DRM\\nstructure remains valid, leading to NULL pointer dereferences when\\naccessing device resources.\\n\\nBUG: kernel NULL pointer dereference, address: 0000000000000000\\nPGD 0 P4D 0\\nOops: Oops: 0000 [#1] SMP NOPTI\\nCPU: 0 UID: 0 PID: 9376 Comm: xe_pat Not tainted 7.2.0-rc2+ #1 PREEMPT(lazy)\\nRIP: 0010:xe_sriov_vf_ccs_rw_update_bb_addr+0x4d/0xa0 [xe]\\nRSP: 0018:ffffcf304110b9c8 EFLAGS: 00010246\\nRAX: ffff8a85c38a0a00 RBX: 00000000810ef000 RCX: 0000000000000000\\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8a85c39c1888\\nRBP: ffffcf304110b9e8 R08: 0000000000000000 R09: 0000000000000000\\nR10: 0000000000000000 R11: 0000000000000000 R12: ffff8a85c39c1888\\nR13: 0000000000000000 R14: ffff8a85c39b4f28 R15: ffff8a85c3885000\\nFS:  0000000000000000(0000) GS:ffff8a878b809000(0000) knlGS:0000000000000000\\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: 0000000000000000 CR3: 000000010314a002 CR4: 0000000000772ef0\\nPKRU: 55555554\\nCall Trace:\\n \u003cTASK\u003e\\n xe_migrate_ccs_rw_copy_clear+0x98/0x120 [xe]\\n xe_sriov_vf_ccs_detach_bo+0x2c/0x60 [xe]\\n xe_ttm_bo_delete_mem_notify+0xc8/0xe0 [xe]\\n ttm_bo_cleanup_memtype_use+0x26/0x80 [ttm]\\n ttm_bo_release+0x29e/0x2d0 [ttm]\\n ttm_bo_fini+0x39/0x70 [ttm]\\n xe_gem_object_free+0x1f/0x30 [xe]\\n drm_gem_object_free+0x1d/0x40\\n ttm_bo_vm_close+0x5f/0x90 [ttm]\\n remove_vma+0x2c/0x70\\n tear_down_vmas+0x63/0xf0\\n exit_mmap+0x20d/0x3f0\\n __mmput+0x45/0x170\\n mmput+0x31/0x40\\n do_exit+0x2ba/0xac0\\n do_group_exit+0x2d/0xb0\\n __x64_sys_exit_group+0x18/0x20\\n x64_sys_call+0x14a0/0x2390\\n do_syscall_64+0xdd/0x640\\n ? count_memcg_events+0xea/0x240\\n ? handle_mm_fault+0x1ec/0x2f0\\n\\n(cherry picked from commit 1ae415a6eefe5004954a1d352b1718faca8844ef)\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/xe/xe_migrate.c\",\"drivers/gpu/drm/xe/xe_migrate.h\",\"drivers/gpu/drm/xe/xe_sriov_vf_ccs.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"864690cf4dd62482b6dd049d82c509886c904303\",\"lessThan\":\"523ed2831ee55b2a1edabdea96781651f9df9685\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"864690cf4dd62482b6dd049d82c509886c904303\",\"lessThan\":\"4c92afb4c143526d340545ca581e88e6952ea511\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/xe/xe_migrate.c\",\"drivers/gpu/drm/xe/xe_migrate.h\",\"drivers/gpu/drm/xe/xe_sriov_vf_ccs.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.6\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4c92afb4c143526d340545ca581e88e6952ea511\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/523ed2831ee55b2a1edabdea96781651f9df9685\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-26T17:08:28+00:00",
      "cve": "CVE-2026-68305",
      "id": "CVE-2026-68305",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_affected": "182",
      "product_status:known_not_affected": "94",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68305.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-14T23:44:47Z",
      "cve": "CVE-2026-68305",
      "id": "CVE-2026-68305",
      "initial_release_date": "2026-08-14T17:14:16Z",
      "product_status:known_not_affected": "296",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68305",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68305.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.