SB20260812263 - Heap-based buffer overflow in Linux kernel drm xe driver

Description

This security bulletin contains information about 1 vulnerability.

1) Heap-based buffer overflow (CVE-ID: CVE-2026-68274)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in the steered register list allocation in drivers/gpu/drm/xe/xe_guc_capture.c when allocating and filling steered register lists for DSS steering. A local user can trigger device unbind on a platform with compute-only DSS bits to cause a denial of service.

The overflow occurs because the allocation size is calculated from the geometry DSS mask alone, while the filling logic iterates over the union of geometry and compute DSS masks, which can corrupt adjacent slab objects and the drmres list_head during drm_managed_release.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/632ecc90e1ca5d3b6822bb4d08f84a175b6c42c0
• https://git.kernel.org/stable/c/a9a020f3c11eba6573b699f9cf9245a51b025ade
• https://git.kernel.org/stable/c/b485bfb45555163bfa5f565d6a3415fcb3035b02