Linux kernel drm/xe GuC: steered register list sized from geometry DSS mask only, overflowing the buffer
Impact
The allocation for the GuC steered register extarray is sized from the geometry DSS mask alone, while the fill loop iterates the union of geometry and compute DSS masks. On parts that have compute-only DSS bits - which is exactly the datacenter and compute-oriented Xe silicon - the driver writes past the allocation and corrupts neighbouring slab objects, showing up as list_del corruption and SLUB redzone overwrites during drmm_release on device unbind. Slab corruption on a GPU node is not contained to the GPU: it damages unrelated kernel allocations on the same host.
Who can reach it
Not remotely reachable. Triggered by driver initialisation on affected hardware; the observed corruption surfaces on device bind/unbind, which requires root or a driver-management path.
What to do
Apply the stable fix that sizes the array from the union of both DSS masks, then reboot the node. Until then, avoid unbind/rebind cycles of the xe driver on affected hosts.
References
Related entries
- Linux kernel drm/xe: SVM state and pagemaps leak on the xe_vm_create() error pathCVE-2026-68298 · Linux kernel drm/xe VM creation (xe_vm_create SVM error unwind)High
- Linux kernel drm/xe VF: NULL dereference detaching CCS buffers after the device is unboundCVE-2026-68305 · Linux kernel drm/xe SR-IOV VF CCS buffer detach (xe_sriov_vf_ccs_detach_bo)High
- Linux kernel drm/xe GuC: async exec queue destruction can deadlock drmm cleanup on device removalCVE-2026-68382 · Linux kernel drm/xe GuC exec queue teardown (device reference lifetime)High
- Linux kernel drm/xe GuC: scheduler keeps a pointer to the exec queue name freed with the queueCVE-2026-68383 · Linux kernel drm/xe GuC submission (scheduler timeline name)High
- Linux kernel drm/xe VF: CCS batch buffers attached/detached without waiting for in-flight BO copyCVE-2026-68384 · Linux kernel drm/xe SR-IOV VF (CCS metadata batch buffers on BO move)High
- Linux kernel vmwgfx: surface array_size taken from userspace without a shader-model boundCVE-2026-68446 · Linux kernel drm/vmwgfx (vmw_surface_metadata::array_size validation)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.