Vulnerability-Lookup

FKIE_CVE-2026-68305

Vulnerability from fkie_nvd - Published: 2026-08-10 13:20 - Updated: 2026-08-17 05:18

Severity

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers CCS read/write buffers are freed during BO destruction. In some cases, BOs may be destroyed after the device is unbound but while the DRM structure remains valid, leading to NULL pointer dereferences when accessing device resources. BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 0 UID: 0 PID: 9376 Comm: xe_pat Not tainted 7.2.0-rc2+ #1 PREEMPT(lazy) RIP: 0010:xe_sriov_vf_ccs_rw_update_bb_addr+0x4d/0xa0 [xe] RSP: 0018:ffffcf304110b9c8 EFLAGS: 00010246 RAX: ffff8a85c38a0a00 RBX: 00000000810ef000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8a85c39c1888 RBP: ffffcf304110b9e8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff8a85c39c1888 R13: 0000000000000000 R14: ffff8a85c39b4f28 R15: ffff8a85c3885000 FS: 0000000000000000(0000) GS:ffff8a878b809000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000010314a002 CR4: 0000000000772ef0 PKRU: 55555554 Call Trace: <TASK> xe_migrate_ccs_rw_copy_clear+0x98/0x120 [xe] xe_sriov_vf_ccs_detach_bo+0x2c/0x60 [xe] xe_ttm_bo_delete_mem_notify+0xc8/0xe0 [xe] ttm_bo_cleanup_memtype_use+0x26/0x80 [ttm] ttm_bo_release+0x29e/0x2d0 [ttm] ttm_bo_fini+0x39/0x70 [ttm] xe_gem_object_free+0x1f/0x30 [xe] drm_gem_object_free+0x1d/0x40 ttm_bo_vm_close+0x5f/0x90 [ttm] remove_vma+0x2c/0x70 tear_down_vmas+0x63/0xf0 exit_mmap+0x20d/0x3f0 __mmput+0x45/0x170 mmput+0x31/0x40 do_exit+0x2ba/0xac0 do_group_exit+0x2d/0xb0 __x64_sys_exit_group+0x18/0x20 x64_sys_call+0x14a0/0x2390 do_syscall_64+0xdd/0x640 ? count_memcg_events+0xea/0x240 ? handle_mm_fault+0x1ec/0x2f0 (cherry picked from commit 1ae415a6eefe5004954a1d352b1718faca8844ef)

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/4c92afb4c143526d340545ca581e88e6952ea511
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/523ed2831ee55b2a1edabdea96781651f9df9685

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_migrate.c",
            "drivers/gpu/drm/xe/xe_migrate.h",
            "drivers/gpu/drm/xe/xe_sriov_vf_ccs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "523ed2831ee55b2a1edabdea96781651f9df9685",
              "status": "affected",
              "version": "864690cf4dd62482b6dd049d82c509886c904303",
              "versionType": "git"
            },
            {
              "lessThan": "4c92afb4c143526d340545ca581e88e6952ea511",
              "status": "affected",
              "version": "864690cf4dd62482b6dd049d82c509886c904303",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_migrate.c",
            "drivers/gpu/drm/xe/xe_migrate.h",
            "drivers/gpu/drm/xe/xe_sriov_vf_ccs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers\n\nCCS read/write buffers are freed during BO destruction. In some cases,\nBOs may be destroyed after the device is unbound but while the DRM\nstructure remains valid, leading to NULL pointer dereferences when\naccessing device resources.\n\nBUG: kernel NULL pointer dereference, address: 0000000000000000\nPGD 0 P4D 0\nOops: Oops: 0000 [#1] SMP NOPTI\nCPU: 0 UID: 0 PID: 9376 Comm: xe_pat Not tainted 7.2.0-rc2+ #1 PREEMPT(lazy)\nRIP: 0010:xe_sriov_vf_ccs_rw_update_bb_addr+0x4d/0xa0 [xe]\nRSP: 0018:ffffcf304110b9c8 EFLAGS: 00010246\nRAX: ffff8a85c38a0a00 RBX: 00000000810ef000 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8a85c39c1888\nRBP: ffffcf304110b9e8 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: ffff8a85c39c1888\nR13: 0000000000000000 R14: ffff8a85c39b4f28 R15: ffff8a85c3885000\nFS:  0000000000000000(0000) GS:ffff8a878b809000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000000 CR3: 000000010314a002 CR4: 0000000000772ef0\nPKRU: 55555554\nCall Trace:\n \u003cTASK\u003e\n xe_migrate_ccs_rw_copy_clear+0x98/0x120 [xe]\n xe_sriov_vf_ccs_detach_bo+0x2c/0x60 [xe]\n xe_ttm_bo_delete_mem_notify+0xc8/0xe0 [xe]\n ttm_bo_cleanup_memtype_use+0x26/0x80 [ttm]\n ttm_bo_release+0x29e/0x2d0 [ttm]\n ttm_bo_fini+0x39/0x70 [ttm]\n xe_gem_object_free+0x1f/0x30 [xe]\n drm_gem_object_free+0x1d/0x40\n ttm_bo_vm_close+0x5f/0x90 [ttm]\n remove_vma+0x2c/0x70\n tear_down_vmas+0x63/0xf0\n exit_mmap+0x20d/0x3f0\n __mmput+0x45/0x170\n mmput+0x31/0x40\n do_exit+0x2ba/0xac0\n do_group_exit+0x2d/0xb0\n __x64_sys_exit_group+0x18/0x20\n x64_sys_call+0x14a0/0x2390\n do_syscall_64+0xdd/0x640\n ? count_memcg_events+0xea/0x240\n ? handle_mm_fault+0x1ec/0x2f0\n\n(cherry picked from commit 1ae415a6eefe5004954a1d352b1718faca8844ef)"
    }
  ],
  "id": "CVE-2026-68305",
  "lastModified": "2026-08-17T05:18:33.373",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-08-10T13:20:20.193",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/4c92afb4c143526d340545ca581e88e6952ea511"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/523ed2831ee55b2a1edabdea96781651f9df9685"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

CVE-2026-68305 (GCVE-0-2026-68305)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:02 – Updated: 2026-08-17 05:02

Title

drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers

Summary

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

2 references

URL	Tags
https://git.kernel.org/stable/c/523ed2831ee55b2a1…
https://git.kernel.org/stable/c/4c92afb4c143526d3…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 864690cf4dd62482b6dd049d82c509886c904303 , < 523ed2831ee55b2a1edabdea96781651f9df9685 (git) Affected: 864690cf4dd62482b6dd049d82c509886c904303 , < 4c92afb4c143526d340545ca581e88e6952ea511 (git)
Linux	Linux	Affected: 6.18 Unaffected: 0 , < 6.18 (semver) Unaffected: 7.1.6 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_migrate.c",
            "drivers/gpu/drm/xe/xe_migrate.h",
            "drivers/gpu/drm/xe/xe_sriov_vf_ccs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "523ed2831ee55b2a1edabdea96781651f9df9685",
              "status": "affected",
              "version": "864690cf4dd62482b6dd049d82c509886c904303",
              "versionType": "git"
            },
            {
              "lessThan": "4c92afb4c143526d340545ca581e88e6952ea511",
              "status": "affected",
              "version": "864690cf4dd62482b6dd049d82c509886c904303",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_migrate.c",
            "drivers/gpu/drm/xe/xe_migrate.h",
            "drivers/gpu/drm/xe/xe_sriov_vf_ccs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers\n\nCCS read/write buffers are freed during BO destruction. In some cases,\nBOs may be destroyed after the device is unbound but while the DRM\nstructure remains valid, leading to NULL pointer dereferences when\naccessing device resources.\n\nBUG: kernel NULL pointer dereference, address: 0000000000000000\nPGD 0 P4D 0\nOops: Oops: 0000 [#1] SMP NOPTI\nCPU: 0 UID: 0 PID: 9376 Comm: xe_pat Not tainted 7.2.0-rc2+ #1 PREEMPT(lazy)\nRIP: 0010:xe_sriov_vf_ccs_rw_update_bb_addr+0x4d/0xa0 [xe]\nRSP: 0018:ffffcf304110b9c8 EFLAGS: 00010246\nRAX: ffff8a85c38a0a00 RBX: 00000000810ef000 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8a85c39c1888\nRBP: ffffcf304110b9e8 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: ffff8a85c39c1888\nR13: 0000000000000000 R14: ffff8a85c39b4f28 R15: ffff8a85c3885000\nFS:  0000000000000000(0000) GS:ffff8a878b809000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000000 CR3: 000000010314a002 CR4: 0000000000772ef0\nPKRU: 55555554\nCall Trace:\n \u003cTASK\u003e\n xe_migrate_ccs_rw_copy_clear+0x98/0x120 [xe]\n xe_sriov_vf_ccs_detach_bo+0x2c/0x60 [xe]\n xe_ttm_bo_delete_mem_notify+0xc8/0xe0 [xe]\n ttm_bo_cleanup_memtype_use+0x26/0x80 [ttm]\n ttm_bo_release+0x29e/0x2d0 [ttm]\n ttm_bo_fini+0x39/0x70 [ttm]\n xe_gem_object_free+0x1f/0x30 [xe]\n drm_gem_object_free+0x1d/0x40\n ttm_bo_vm_close+0x5f/0x90 [ttm]\n remove_vma+0x2c/0x70\n tear_down_vmas+0x63/0xf0\n exit_mmap+0x20d/0x3f0\n __mmput+0x45/0x170\n mmput+0x31/0x40\n do_exit+0x2ba/0xac0\n do_group_exit+0x2d/0xb0\n __x64_sys_exit_group+0x18/0x20\n x64_sys_call+0x14a0/0x2390\n do_syscall_64+0xdd/0x640\n ? count_memcg_events+0xea/0x240\n ? handle_mm_fault+0x1ec/0x2f0\n\n(cherry picked from commit 1ae415a6eefe5004954a1d352b1718faca8844ef)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The path is reached through the local DRM device (/dev/dri/renderD*) \u2014 GEM object creation/mmap and process teardown driving TTM BO destruction; no network or remote input is involved.\nAC:L - No race must be won: a local user only needs live CCS-attached BOs when the device is unbound/hot-removed, after which every subsequent BO release deterministically walks the stale pointers, and BO lifetime is fully under the user\u0027s control.\nPR:L - Only ordinary access to the render node is required to create and hold the CCS-attached buffer objects whose destruction triggers the fault; no capability check guards xe_sriov_vf_ccs_detach_bo().\nUI:N - The faulting code runs automatically from the BO release path (exit_mmap/ttm_bo_release) with no action by any other user; the unbind/hot-remove event is an administrative or host-side operation, not victim interaction.\nS:U - The freed objects and the resulting corruption all belong to the same kernel within the VF guest; no VM, IOMMU or sandbox boundary is crossed.\nC:H - After unbind, ctx-\u003emig_q, pool-\u003ebo/shadow and pool-\u003ecpu_addr are dangling devm-freed objects that are read (xe_mem_pool_swap_shadow_locked, xe_map_memcpy_to from pool-\u003ecpu_addr), so reallocated kernel memory can be read and its contents propagated, giving a use-after-free disclosure primitive.\nI:H - The same path writes through the stale mappings \u2014 memset(cs, MI_NOOP, bb-\u003esa_node.size), xe_map_wr into the freed LRC BO vmap and a memcpy into the freed shadow BO \u2014 so freed memory that may already be reused is overwritten, a use-after-free write primitive.\nA:H - The reported and reproducible outcome is a kernel NULL pointer dereference oops in xe_sriov_vf_ccs_rw_update_bb_addr() during process exit, killing the task in kernel context and destabilizing the machine."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:02:57.484Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/523ed2831ee55b2a1edabdea96781651f9df9685"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c92afb4c143526d340545ca581e88e6952ea511"
        }
      ],
      "title": "drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68305",
    "datePublished": "2026-08-10T12:02:39.911Z",
    "dateReserved": "2026-07-30T09:28:09.381Z",
    "dateUpdated": "2026-08-17T05:02:57.484Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

FKIE_CVE-2026-68305

CVE-2026-68305 (GCVE-0-2026-68305)

Tags

Sightings

Nomenclature