ghsa-wh8m-6mqf-wcpv
Vulnerability from github
In the Linux kernel, the following vulnerability has been resolved:
drm/xe/migrate: don't overflow max copy size
With non-page aligned copy, we need to use 4 byte aligned pitch, however the size itself might still be close to our maximum of ~8M, and so the dimensions of the copy can easily exceed the S16_MAX limit of the copy command leading to the following assert:
xe 0000:03:00.0: [drm] Assertion size / pitch <= ((s16)(((u16)~0U) >> 1)) failed!
platform: BATTLEMAGE subplatform: 1
graphics: Xe2_HPG 20.01 step A0
media: Xe2_HPM 13.01 step A1
tile: 0 VRAM 10.0 GiB
GT: 0 type 1
WARNING: CPU: 23 PID: 10605 at drivers/gpu/drm/xe/xe_migrate.c:673 emit_copy+0x4b5/0x4e0 [xe]
To fix this account for the pitch when calculating the number of current bytes to copy.
(cherry picked from commit 8c2d61e0e916e077fda7e7b8e67f25ffe0f361fc)
{
"affected": [],
"aliases": [
"CVE-2025-39741"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-11T17:15:36Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/migrate: don\u0027t overflow max copy size\n\nWith non-page aligned copy, we need to use 4 byte aligned pitch, however\nthe size itself might still be close to our maximum of ~8M, and so the\ndimensions of the copy can easily exceed the S16_MAX limit of the copy\ncommand leading to the following assert:\n\nxe 0000:03:00.0: [drm] Assertion `size / pitch \u003c= ((s16)(((u16)~0U) \u003e\u003e 1))` failed!\nplatform: BATTLEMAGE subplatform: 1\ngraphics: Xe2_HPG 20.01 step A0\nmedia: Xe2_HPM 13.01 step A1\ntile: 0 VRAM 10.0 GiB\nGT: 0 type 1\n\nWARNING: CPU: 23 PID: 10605 at drivers/gpu/drm/xe/xe_migrate.c:673 emit_copy+0x4b5/0x4e0 [xe]\n\nTo fix this account for the pitch when calculating the number of current\nbytes to copy.\n\n(cherry picked from commit 8c2d61e0e916e077fda7e7b8e67f25ffe0f361fc)",
"id": "GHSA-wh8m-6mqf-wcpv",
"modified": "2025-09-11T18:35:51Z",
"published": "2025-09-11T18:35:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-39741"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4126cb327a2e3273c81fcef1c594c5b7b645c44c"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7257cc6644d540130a46a61531a07a0517cace89"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.