CVE-2025-37761

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

drm/xe: Fix an out-of-bounds shift when invalidating TLB

When the size of the range invalidated is larger than

rounddown_pow_of_two(ULONG_MAX),

The function macro roundup_pow_of_two(length) will hit an out-of-bounds

shift [1].

Use a full TLB invalidation for such cases.

v2:

- Use a define for the range size limit over which we use a full

TLB invalidation. (Lucas)

- Use a better calculation of the limit.

[1]:

[ 39.202421] ------------[ cut here ]------------

[ 39.202657] UBSAN: shift-out-of-bounds in ./include/linux/log2.h:57:13

[ 39.202673] shift exponent 64 is too large for 64-bit type 'long unsigned int'

[ 39.202688] CPU: 8 UID: 0 PID: 3129 Comm: xe_exec_system_ Tainted: G U 6.14.0+ #10

[ 39.202690] Tainted: [U]=USER

[ 39.202690] Hardware name: ASUS System Product Name/PRIME B560M-A AC, BIOS 2001 02/01/2023

[ 39.202691] Call Trace:

[ 39.202692] <TASK>

[ 39.202695] dump_stack_

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References