226 lines
13 KiB
JSON
226 lines
13 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-68264",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-07-30T09:28:09.378Z",
|
|
"datePublished": "2026-08-10T12:01:38.686Z",
|
|
"dateUpdated": "2026-10-19T20:58:58.651Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-17T05:01:56.847Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/pt: Reset current_op in xe_pt_update_ops_init()\n\nxe_pt_update_ops_init() fails to reset current_op to 0. On the\nvm_bind path, ops_execute() calls xe_pt_update_ops_prepare() inside\nthe xe_validation_guard() / drm_exec_until_all_locked() loop. When\nthat loop retries due to lock contention or OOM eviction\n(drm_exec_retry_on_contention() / xe_validation_retry_on_oom()),\nxe_pt_update_ops_prepare() runs again on the same vops, and each\ncall to bind_op_prepare() increments current_op without resetting it.\n\nAfter N retries current_op exceeds the array size allocated by\nxe_vma_ops_alloc(), causing an out-of-bounds write into\nSLUB-poisoned memory and a subsequent UAF crash in\nxe_migrate_update_pgtables_cpu() when reading the corrupted pt_op->bind.\n\nAlso reset needs_svm_lock and needs_invalidation which are derived in\nthe same prepare pass and would otherwise cause wrong migrate ops\nselection and redundant TLB invalidation on retry.\n\nFix this by resetting current_op, needs_svm_lock and needs_invalidation\nin xe_pt_update_ops_init().\n\nv2 (Matt):\n - Add details in commit message.\n - Add Fixes tag and Cc to stable@vger.kernel.org\n\n(cherry picked from commit 046045543e530605c441063535e7dca0075369a6)"
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 7.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - The bug is reached through the DRM_IOCTL_XE_VM_BIND ioctl on an Intel Xe DRM render node (/dev/dri/renderD*), which requires local access to the device file; there is no remote or adjacent-network path.\nAC:L - The overflow needs only one retry of the xe_validation_guard()/drm_exec_until_all_locked() loop, and the attacker drives both retry sources itself: concurrent vm_bind/exec threads on the same BOs force drm_exec_retry_on_contention(), and filling VRAM forces xe_validation_retry_on_oom(). Both sides of the race are attacker-controlled and the sequence is repeatable at will.\nPR:L - Only an open file descriptor on the Xe render node plus a VM created via DRM_IOCTL_XE_VM_CREATE is needed; no capability check exists on the vm_bind path. Render nodes are routinely accessible to unprivileged users, Android apps, containers and GPU-sharing tenants.\nUI:N - The attacker performs the entire sequence (vm create, bo create, vm_bind with induced contention/memory pressure) from its own process; no victim action is required.\nS:U - The out-of-bounds write and the subsequent corrupted-pointer use occur in kernel heap memory within the same security authority as the kernel itself; no VM, IOMMU or sandbox boundary is crossed by the flaw itself.\nC:H - After the index inflates, xe_pt_update_ops_fini()/xe_pt_update_ops_abort() iterate i < current_op and read adjacent-slab contents as xe_vma/pt pointers and num_entries, and xe_migrate_update_pgtables_cpu() consumes the corrupted pt_op, giving out-of-bounds reads of kernel objects and a UAF that can be groomed into an arbitrary-read primitive.\nI:H - Each retry writes a full struct xe_vm_pgtable_update_op (pointer-rich entries[] plus vma pointer and flags) past the end of the kmalloc'd ops array, with attacker-chosen overflow length and slab size, and the corrupted entries are later fed to xe_pt_free_bind()/xe_pt_abort_bind() and GPU page-table programming — a controllable heap corruption suitable for privilege escalation.\nA:H - The commit documents an out-of-bounds write into SLUB-poisoned memory followed by a UAF crash in xe_migrate_update_pgtables_cpu(); an unprivileged process can reliably and repeatedly panic the kernel, and corrupted page-table state additionally wedges the GPU."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/gpu/drm/xe/xe_pt.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "e8babb280b5ef904df54b3a90e5a7e3a9600c4a9",
|
|
"lessThan": "be5c39730ab8f1dfe59983bf7d8e3705541d1fee",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "e8babb280b5ef904df54b3a90e5a7e3a9600c4a9",
|
|
"lessThan": "157b1e3384d7d37f59c0c2b2ff2af8f557db1daa",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "e8babb280b5ef904df54b3a90e5a7e3a9600c4a9",
|
|
"lessThan": "90e4fd331b980259c40118d05b89b0ec514e7c48",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "e8babb280b5ef904df54b3a90e5a7e3a9600c4a9",
|
|
"lessThan": "6384271ac1ac0099198d15df79212a19ebdb929d",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/gpu/drm/xe/xe_pt.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "6.12",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "6.12",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.103",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.44",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.1.6",
|
|
"lessThanOrEqual": "7.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.2",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.12",
|
|
"versionEndExcluding": "6.12.103"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.12",
|
|
"versionEndExcluding": "6.18.44"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.12",
|
|
"versionEndExcluding": "7.1.6"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.12",
|
|
"versionEndExcluding": "7.2"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/be5c39730ab8f1dfe59983bf7d8e3705541d1fee"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/157b1e3384d7d37f59c0c2b2ff2af8f557db1daa"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/90e4fd331b980259c40118d05b89b0ec514e7c48"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/6384271ac1ac0099198d15df79212a19ebdb929d"
|
|
}
|
|
],
|
|
"title": "drm/xe/pt: Reset current_op in xe_pt_update_ops_init()",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
},
|
|
"adp": [
|
|
{
|
|
"metrics": [
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"id": "CVE-2026-68264",
|
|
"role": "CISA Coordinator",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "no"
|
|
},
|
|
{
|
|
"Technical Impact": "total"
|
|
}
|
|
],
|
|
"version": "2.0.3",
|
|
"timestamp": "2026-10-16T15:46:21.749060Z"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"problemTypes": [
|
|
{
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"type": "CWE",
|
|
"cweId": "CWE-787",
|
|
"description": "CWE-787 Out-of-bounds Write"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2026-10-19T20:58:58.651Z"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |