CVE-2026-68274

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/guc: Fix buffer overflow in steered register list allocation

The size calculation for the steered register extarray uses only the

geometry DSS mask (g_dss_mask) to determine the number of entries to

allocate:

total = bitmap_weight(gt->fuse_topo.g_dss_mask, ...) * steer_reg_num;

However, the filling loop uses for_each_dss_steering(), which iterates

over for_each_dss(), defined as the union of g_dss_mask and c_dss_mask

(geometry + compute DSS). On platforms with compute-only DSS bits, the

loop writes past the allocated buffer, corrupting adjacent slab objects.

This manifests as list_del corruption and SLUB redzone overwrites during

drm_managed_release on device unbind, since the overflow corrupts the

drmres list_head of neighboring allocations.

Fix by computing the allocation size using the union of both DSS masks,

matching the iteration pattern of for_each_dss_steering().

--

v2:

- use bitmap_weighted_or(

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References