CVE-2026-68265

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The bug is reached only through the DRM_IOCTL_XE_VM_BIND ioctl on an xe render node (/dev/dri/renderD*), which requires local access to the device file; there is no network-facing path into drivers/gpu/drm/xe/xe_vm.c.

AC:LAttack complexity, low

Fully deterministic and attacker-controlled: map any BO, then issue a PREFETCH bind op with prefetch_region = DRM_XE_CONSULT_MEM_ADVISE_PREF_LOC (-1), which the ioctl validator explicitly accepts, and the out-of-bounds index is taken every time. No race, no memory-layout grooming, and no special config beyond a normal Intel Xe GPU.

PR:LPrivileges required, low

XE_VM_BIND is registered DRM_RENDER_ALLOW, so any unprivileged user or sandboxed/containerized process holding a render-node fd (the norm for desktop, Android and GPU containers) can drive the path; no capability or root is needed.

UI:NUser interaction, none

The attacker performs the entire sequence (create BO, bind, prefetch) from their own process via ioctls; no victim action or interaction is required.

S:UScope, unchanged

The out-of-bounds access and any resulting fault or misbehaviour stay within the kernel of the same machine and are not mediated across a VM, IOMMU or other security authority boundary.

C:HConfidentiality impact, high

region_to_mem_type[] is a 3-entry array indexed with 0xFFFFFFFF, an unbounded wild read roughly 16 GB past the object rather than a small bounded overread; the loaded word is consumed by the driver and, on layouts where the address is readable, exposes memory the caller must never observe, so a high confidentiality impact is the defensible assessment.

I:LIntegrity impact, low

The out-of-bounds word is used directly as the mem_type argument to xe_bo_migrate(), so uninitialized/foreign data drives xe_bo_can_migrate(), mem_type_is_vram() and add_vram() placement decisions, letting a buffer object be moved to a memory region the caller never requested; the subsequent placement check bounds this to limited modification rather than an arbitrary write.

A:HAvailability impact, high

The 0xFFFFFFFF index computes an address far outside any valid mapping (on x86-64 the module-relative offset wraps into a non-kernel address), so the read faults in kernel mode inside an in-progress drm_exec transaction holding VM and BO locks, producing an oops and a wedged GPU context — a repeatable crash any local user can trigger.