CVE-2026-68305 (GCVE-0-2026-68305)
Vulnerability from cvelistv5
Published
2026-08-10 12:02
Modified
2026-10-19 21:09
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers
CCS read/write buffers are freed during BO destruction. In some cases,
BOs may be destroyed after the device is unbound but while the DRM
structure remains valid, leading to NULL pointer dereferences when
accessing device resources.
BUG: kernel NULL pointer dereference, address: 0000000000000000
PGD 0 P4D 0
Oops: Oops: 0000 [#1] SMP NOPTI
CPU: 0 UID: 0 PID: 9376 Comm: xe_pat Not tainted 7.2.0-rc2+ #1 PREEMPT(lazy)
RIP: 0010:xe_sriov_vf_ccs_rw_update_bb_addr+0x4d/0xa0 [xe]
RSP: 0018:ffffcf304110b9c8 EFLAGS: 00010246
RAX: ffff8a85c38a0a00 RBX: 00000000810ef000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8a85c39c1888
RBP: ffffcf304110b9e8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8a85c39c1888
R13: 0000000000000000 R14: ffff8a85c39b4f28 R15: ffff8a85c3885000
FS: 0000000000000000(0000) GS:ffff8a878b809000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000010314a002 CR4: 0000000000772ef0
PKRU: 55555554
Call Trace:
<TASK>
xe_migrate_ccs_rw_copy_clear+0x98/0x120 [xe]
xe_sriov_vf_ccs_detach_bo+0x2c/0x60 [xe]
xe_ttm_bo_delete_mem_notify+0xc8/0xe0 [xe]
ttm_bo_cleanup_memtype_use+0x26/0x80 [ttm]
ttm_bo_release+0x29e/0x2d0 [ttm]
ttm_bo_fini+0x39/0x70 [ttm]
xe_gem_object_free+0x1f/0x30 [xe]
drm_gem_object_free+0x1d/0x40
ttm_bo_vm_close+0x5f/0x90 [ttm]
remove_vma+0x2c/0x70
tear_down_vmas+0x63/0xf0
exit_mmap+0x20d/0x3f0
__mmput+0x45/0x170
mmput+0x31/0x40
do_exit+0x2ba/0xac0
do_group_exit+0x2d/0xb0
__x64_sys_exit_group+0x18/0x20
x64_sys_call+0x14a0/0x2390
do_syscall_64+0xdd/0x640
? count_memcg_events+0xea/0x240
? handle_mm_fault+0x1ec/0x2f0
(cherry picked from commit 1ae415a6eefe5004954a1d352b1718faca8844ef)
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68305",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:46:57.730794Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476 NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:09:04.378Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/xe/xe_migrate.c",
"drivers/gpu/drm/xe/xe_migrate.h",
"drivers/gpu/drm/xe/xe_sriov_vf_ccs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0c07e046e639160a1597830c4c5615ee2a4a5ed5",
"status": "affected",
"version": "864690cf4dd62482b6dd049d82c509886c904303",
"versionType": "git"
},
{
"lessThan": "523ed2831ee55b2a1edabdea96781651f9df9685",
"status": "affected",
"version": "864690cf4dd62482b6dd049d82c509886c904303",
"versionType": "git"
},
{
"lessThan": "4c92afb4c143526d340545ca581e88e6952ea511",
"status": "affected",
"version": "864690cf4dd62482b6dd049d82c509886c904303",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/xe/xe_migrate.c",
"drivers/gpu/drm/xe/xe_migrate.h",
"drivers/gpu/drm/xe/xe_sriov_vf_ccs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.18"
},
{
"lessThan": "6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers\n\nCCS read/write buffers are freed during BO destruction. In some cases,\nBOs may be destroyed after the device is unbound but while the DRM\nstructure remains valid, leading to NULL pointer dereferences when\naccessing device resources.\n\nBUG: kernel NULL pointer dereference, address: 0000000000000000\nPGD 0 P4D 0\nOops: Oops: 0000 [#1] SMP NOPTI\nCPU: 0 UID: 0 PID: 9376 Comm: xe_pat Not tainted 7.2.0-rc2+ #1 PREEMPT(lazy)\nRIP: 0010:xe_sriov_vf_ccs_rw_update_bb_addr+0x4d/0xa0 [xe]\nRSP: 0018:ffffcf304110b9c8 EFLAGS: 00010246\nRAX: ffff8a85c38a0a00 RBX: 00000000810ef000 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8a85c39c1888\nRBP: ffffcf304110b9e8 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: ffff8a85c39c1888\nR13: 0000000000000000 R14: ffff8a85c39b4f28 R15: ffff8a85c3885000\nFS: 0000000000000000(0000) GS:ffff8a878b809000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000000 CR3: 000000010314a002 CR4: 0000000000772ef0\nPKRU: 55555554\nCall Trace:\n \u003cTASK\u003e\n xe_migrate_ccs_rw_copy_clear+0x98/0x120 [xe]\n xe_sriov_vf_ccs_detach_bo+0x2c/0x60 [xe]\n xe_ttm_bo_delete_mem_notify+0xc8/0xe0 [xe]\n ttm_bo_cleanup_memtype_use+0x26/0x80 [ttm]\n ttm_bo_release+0x29e/0x2d0 [ttm]\n ttm_bo_fini+0x39/0x70 [ttm]\n xe_gem_object_free+0x1f/0x30 [xe]\n drm_gem_object_free+0x1d/0x40\n ttm_bo_vm_close+0x5f/0x90 [ttm]\n remove_vma+0x2c/0x70\n tear_down_vmas+0x63/0xf0\n exit_mmap+0x20d/0x3f0\n __mmput+0x45/0x170\n mmput+0x31/0x40\n do_exit+0x2ba/0xac0\n do_group_exit+0x2d/0xb0\n __x64_sys_exit_group+0x18/0x20\n x64_sys_call+0x14a0/0x2390\n do_syscall_64+0xdd/0x640\n ? count_memcg_events+0xea/0x240\n ? handle_mm_fault+0x1ec/0x2f0\n\n(cherry picked from commit 1ae415a6eefe5004954a1d352b1718faca8844ef)"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The path is reached through the local DRM device (/dev/dri/renderD*) \u2014 GEM object creation/mmap and process teardown driving TTM BO destruction; no network or remote input is involved.\nAC:L - No race must be won: a local user only needs live CCS-attached BOs when the device is unbound/hot-removed, after which every subsequent BO release deterministically walks the stale pointers, and BO lifetime is fully under the user\u0027s control.\nPR:L - Only ordinary access to the render node is required to create and hold the CCS-attached buffer objects whose destruction triggers the fault; no capability check guards xe_sriov_vf_ccs_detach_bo().\nUI:N - The faulting code runs automatically from the BO release path (exit_mmap/ttm_bo_release) with no action by any other user; the unbind/hot-remove event is an administrative or host-side operation, not victim interaction.\nS:U - The freed objects and the resulting corruption all belong to the same kernel within the VF guest; no VM, IOMMU or sandbox boundary is crossed.\nC:H - After unbind, ctx-\u003emig_q, pool-\u003ebo/shadow and pool-\u003ecpu_addr are dangling devm-freed objects that are read (xe_mem_pool_swap_shadow_locked, xe_map_memcpy_to from pool-\u003ecpu_addr), so reallocated kernel memory can be read and its contents propagated, giving a use-after-free disclosure primitive.\nI:H - The same path writes through the stale mappings \u2014 memset(cs, MI_NOOP, bb-\u003esa_node.size), xe_map_wr into the freed LRC BO vmap and a memcpy into the freed shadow BO \u2014 so freed memory that may already be reused is overwritten, a use-after-free write primitive.\nA:H - The reported and reproducible outcome is a kernel NULL pointer dereference oops in xe_sriov_vf_ccs_rw_update_bb_addr() during process exit, killing the task in kernel context and destabilizing the machine."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T10:08:16.912Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0c07e046e639160a1597830c4c5615ee2a4a5ed5"
},
{
"url": "https://git.kernel.org/stable/c/523ed2831ee55b2a1edabdea96781651f9df9685"
},
{
"url": "https://git.kernel.org/stable/c/4c92afb4c143526d340545ca581e88e6952ea511"
}
],
"title": "drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68305",
"datePublished": "2026-08-10T12:02:39.911Z",
"dateReserved": "2026-07-30T09:28:09.381Z",
"dateUpdated": "2026-10-19T21:09:04.378Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-68305\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-16T15:46:57.730794Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-476\", \"description\": \"CWE-476 NULL Pointer Dereference\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-16T15:46:58.310Z\"}}], \"cna\": {\"title\": \"drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The path is reached through the local DRM device (/dev/dri/renderD*) \\u2014 GEM object creation/mmap and process teardown driving TTM BO destruction; no network or remote input is involved.\\nAC:L - No race must be won: a local user only needs live CCS-attached BOs when the device is unbound/hot-removed, after which every subsequent BO release deterministically walks the stale pointers, and BO lifetime is fully under the user\u0027s control.\\nPR:L - Only ordinary access to the render node is required to create and hold the CCS-attached buffer objects whose destruction triggers the fault; no capability check guards xe_sriov_vf_ccs_detach_bo().\\nUI:N - The faulting code runs automatically from the BO release path (exit_mmap/ttm_bo_release) with no action by any other user; the unbind/hot-remove event is an administrative or host-side operation, not victim interaction.\\nS:U - The freed objects and the resulting corruption all belong to the same kernel within the VF guest; no VM, IOMMU or sandbox boundary is crossed.\\nC:H - After unbind, ctx-\u003emig_q, pool-\u003ebo/shadow and pool-\u003ecpu_addr are dangling devm-freed objects that are read (xe_mem_pool_swap_shadow_locked, xe_map_memcpy_to from pool-\u003ecpu_addr), so reallocated kernel memory can be read and its contents propagated, giving a use-after-free disclosure primitive.\\nI:H - The same path writes through the stale mappings \\u2014 memset(cs, MI_NOOP, bb-\u003esa_node.size), xe_map_wr into the freed LRC BO vmap and a memcpy into the freed shadow BO \\u2014 so freed memory that may already be reused is overwritten, a use-after-free write primitive.\\nA:H - The reported and reproducible outcome is a kernel NULL pointer dereference oops in xe_sriov_vf_ccs_rw_update_bb_addr() during process exit, killing the task in kernel context and destabilizing the machine.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"864690cf4dd62482b6dd049d82c509886c904303\", \"lessThan\": \"0c07e046e639160a1597830c4c5615ee2a4a5ed5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"864690cf4dd62482b6dd049d82c509886c904303\", \"lessThan\": \"523ed2831ee55b2a1edabdea96781651f9df9685\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"864690cf4dd62482b6dd049d82c509886c904303\", \"lessThan\": \"4c92afb4c143526d340545ca581e88e6952ea511\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/gpu/drm/xe/xe_migrate.c\", \"drivers/gpu/drm/xe/xe_migrate.h\", \"drivers/gpu/drm/xe/xe_sriov_vf_ccs.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.18\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.18\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.18.57\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.18.*\"}, {\"status\": \"unaffected\", \"version\": \"7.1.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.1.*\"}, {\"status\": \"unaffected\", \"version\": \"7.2\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/gpu/drm/xe/xe_migrate.c\", \"drivers/gpu/drm/xe/xe_migrate.h\", \"drivers/gpu/drm/xe/xe_sriov_vf_ccs.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/0c07e046e639160a1597830c4c5615ee2a4a5ed5\"}, {\"url\": \"https://git.kernel.org/stable/c/523ed2831ee55b2a1edabdea96781651f9df9685\"}, {\"url\": \"https://git.kernel.org/stable/c/4c92afb4c143526d340545ca581e88e6952ea511\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers\\n\\nCCS read/write buffers are freed during BO destruction. In some cases,\\nBOs may be destroyed after the device is unbound but while the DRM\\nstructure remains valid, leading to NULL pointer dereferences when\\naccessing device resources.\\n\\nBUG: kernel NULL pointer dereference, address: 0000000000000000\\nPGD 0 P4D 0\\nOops: Oops: 0000 [#1] SMP NOPTI\\nCPU: 0 UID: 0 PID: 9376 Comm: xe_pat Not tainted 7.2.0-rc2+ #1 PREEMPT(lazy)\\nRIP: 0010:xe_sriov_vf_ccs_rw_update_bb_addr+0x4d/0xa0 [xe]\\nRSP: 0018:ffffcf304110b9c8 EFLAGS: 00010246\\nRAX: ffff8a85c38a0a00 RBX: 00000000810ef000 RCX: 0000000000000000\\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8a85c39c1888\\nRBP: ffffcf304110b9e8 R08: 0000000000000000 R09: 0000000000000000\\nR10: 0000000000000000 R11: 0000000000000000 R12: ffff8a85c39c1888\\nR13: 0000000000000000 R14: ffff8a85c39b4f28 R15: ffff8a85c3885000\\nFS: 0000000000000000(0000) GS:ffff8a878b809000(0000) knlGS:0000000000000000\\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: 0000000000000000 CR3: 000000010314a002 CR4: 0000000000772ef0\\nPKRU: 55555554\\nCall Trace:\\n \u003cTASK\u003e\\n xe_migrate_ccs_rw_copy_clear+0x98/0x120 [xe]\\n xe_sriov_vf_ccs_detach_bo+0x2c/0x60 [xe]\\n xe_ttm_bo_delete_mem_notify+0xc8/0xe0 [xe]\\n ttm_bo_cleanup_memtype_use+0x26/0x80 [ttm]\\n ttm_bo_release+0x29e/0x2d0 [ttm]\\n ttm_bo_fini+0x39/0x70 [ttm]\\n xe_gem_object_free+0x1f/0x30 [xe]\\n drm_gem_object_free+0x1d/0x40\\n ttm_bo_vm_close+0x5f/0x90 [ttm]\\n remove_vma+0x2c/0x70\\n tear_down_vmas+0x63/0xf0\\n exit_mmap+0x20d/0x3f0\\n __mmput+0x45/0x170\\n mmput+0x31/0x40\\n do_exit+0x2ba/0xac0\\n do_group_exit+0x2d/0xb0\\n __x64_sys_exit_group+0x18/0x20\\n x64_sys_call+0x14a0/0x2390\\n do_syscall_64+0xdd/0x640\\n ? count_memcg_events+0xea/0x240\\n ? handle_mm_fault+0x1ec/0x2f0\\n\\n(cherry picked from commit 1ae415a6eefe5004954a1d352b1718faca8844ef)\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.18.57\", \"versionStartIncluding\": \"6.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.1.6\", \"versionStartIncluding\": \"6.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.2\", \"versionStartIncluding\": \"6.18\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-10-15T10:08:16.912Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-68305\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-19T21:09:04.378Z\", \"dateReserved\": \"2026-07-30T09:28:09.381Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2026-08-10T12:02:39.911Z\", \"assignerShortName\": \"Linux\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…