CVE-2026-68264

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/pt: Reset current_op in xe_pt_update_ops_init()

xe_pt_update_ops_init() fails to reset current_op to 0. On the

vm_bind path, ops_execute() calls xe_pt_update_ops_prepare() inside

the xe_validation_guard() / drm_exec_until_all_locked() loop. When

that loop retries due to lock contention or OOM eviction

(drm_exec_retry_on_contention() / xe_validation_retry_on_oom()),

xe_pt_update_ops_prepare() runs again on the same vops, and each

call to bind_op_prepare() increments current_op without resetting it.

After N retries current_op exceeds the array size allocated by

xe_vma_ops_alloc(), causing an out-of-bounds write into

SLUB-poisoned memory and a subsequent UAF crash in

xe_migrate_update_pgtables_cpu() when reading the corrupted pt_op->bind.

Also reset needs_svm_lock and needs_invalidation which are derived in

the same prepare pass and would otherwise cause wrong migrate ops

selection and redundant TLB invalidatio

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References