SB20260812269 - Out-of-bounds write in Linux kernel drm xe driver

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds write (CVE-ID: CVE-2026-68264)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in xe_pt_update_ops_init() and the vm_bind path in the xe driver when retrying page table update preparation after lock contention or OOM eviction. A local user can trigger repeated retries to cause a denial of service.

The issue can corrupt SLUB-poisoned memory and lead to a subsequent use-after-free crash in xe_migrate_update_pgtables_cpu().

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/157b1e3384d7d37f59c0c2b2ff2af8f557db1daa
• https://git.kernel.org/stable/c/6384271ac1ac0099198d15df79212a19ebdb929d
• https://git.kernel.org/stable/c/90e4fd331b980259c40118d05b89b0ec514e7c48
• https://git.kernel.org/stable/c/be5c39730ab8f1dfe59983bf7d8e3705541d1fee