Linux kernel drm/xe: unreset current_op on vm_bind retry overflows the page-table op array
Impact
On Intel Xe GPUs (including Data Center GPU Max parts), xe_pt_update_ops_init() does not reset current_op, so each retry of the vm_bind preparation loop - triggered by lock contention or OOM eviction, both routine on a loaded multi-tenant node - keeps incrementing the index past the array allocated by xe_vma_ops_alloc(). The result is an out-of-bounds write into SLUB memory followed by a use-after-free in xe_migrate_update_pgtables_cpu(). Any local process holding a render node can drive vm_bind and provoke the retry path, which makes this a plausible local privilege-escalation primitive on a shared GPU node rather than a mere crash.
Who can reach it
Local user with access to the Xe DRM render node (any tenant with an Intel GPU workload container). No special privilege beyond opening the device; no remote path.
What to do
Take the stable kernel fix for your series and reboot the node. There is no module-reload workaround that is safe here - the bug lives in the memory manager of the live driver - so plan a drain and reboot per affected host.
References
Related entries
- Linux kernel drm/xe: imported dma-buf BO can outlive the exporter, giving a use-after-free on the shared resvCVE-2026-68266 · Linux kernel drm/xe dma-buf import (xe_bo_init_locked)High
- Linux kernel amdgpu RAS / GPU reset and recovery path (drm/amdgpu): A use-after-free in the amdgpu RAS / GPU reset andCVE-2026-68273 · Linux kernel amdgpu RAS / GPU reset and recovery path (drm/amdgpu)High
- Linux kernel drm/xe GuC: steered register list sized from geometry DSS mask only, overflowing the bufferCVE-2026-68274 · Linux kernel drm/xe GuC steered register list allocationHigh
- Linux kernel drm/xe: SVM state and pagemaps leak on the xe_vm_create() error pathCVE-2026-68298 · Linux kernel drm/xe VM creation (xe_vm_create SVM error unwind)High
- Linux kernel drm/xe VF: NULL dereference detaching CCS buffers after the device is unboundCVE-2026-68305 · Linux kernel drm/xe SR-IOV VF CCS buffer detach (xe_sriov_vf_ccs_detach_bo)High
- Linux kernel drm/xe GuC: async exec queue destruction can deadlock drmm cleanup on device removalCVE-2026-68382 · Linux kernel drm/xe GuC exec queue teardown (device reference lifetime)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.