Look up another CVE · open CVE-2026-68305 in the interactive tracker

CVE-2026-68305

drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers

7.8 EPSS 0.2% AV:L

Published 2026-08-10 (2 months ago) by the Linux kernel CNA. Subsystem drivers/gpu. Debian urgency: unimportant.

What to do, per Debian release

Debian's own status for CVE-2026-68305 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source

Release	Status	Version	What this means
Debian 12bookworm	not affected	6.1.190-1	Nothing to do. bookworm never shipped the vulnerable code.
Debian 13trixie	not affected	6.12.113-1	Nothing to do. trixie never shipped the vulnerable code.
Debian 14forky	fixed	7.1.6-1	Update the kernel and reboot. Fixed in 7.1.6-1. A running kernel keeps the old code until the machine restarts.
Debian unstablesid	fixed	7.1.6-1	Update the kernel and reboot. Fixed in 7.1.6-1. A running kernel keeps the old code until the machine restarts.

The vulnerability

What the bug is

CCS read/write buffers are freed during BO destruction. In some cases, BOs may be destroyed after the device is unbound but while the DRM structure remains valid, leading to NULL pointer dereferences when accessing device resources. BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 0 UID: 0 PID: 9376 Comm: xe_pat Not tainted 7.2.0-rc2+ #1 PREEMPT(lazy) RIP: 0010:xe_sriov_vf_ccs_rw_update_bb_addr+0x4d/0xa0 [xe] RSP: 0018:ffffcf304110b9c8 EFLAGS: 00010246 RAX: ffff8a85c38a0a00 RBX: 00000000810ef000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8a85c39c1888 RBP: ffffcf304110b9e8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff8a85c39c1888 R13: 0000000000000000 R14: ffff8a85c39b4f28 R15: ffff8a85c3885000 FS: 0000000000000000(0000) GS:ffff8a878b809000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000010314a002 CR4: 0000000000772ef0 PKRU: 55555554 Call Trace: <TASK> xe_migrate_ccs_rw_copy_clear+0x98/0x120 [xe] xe_sriov_vf_ccs_detach_bo+0x2c/0x60 [xe] xe_ttm_bo_delete_mem_notify+0xc8/0xe0 [xe] ttm_bo_cleanup_memtype_use+0x26/0x80 [ttm] ttm_bo_release+0x29e/0x2d0 [ttm] ttm_bo_fini+0x39/0x70 [ttm] xe_gem_object_free+0x1f/0x30 [xe] drm_gem_object_free+0x1d/0x40 ttm_bo_vm_close+0x5f/0x90 [ttm] remove_vma+0x2c/0x70 tear_down_vmas+0x63/0xf0 exit_mmap+0x20d/0x3f0 __mmput+0x45/0x170 mmput+0x31/0x40 do_exit+0x2ba/0xac0 do_group_exit+0x2d/0xb0 __x64_sys_exit_group+0x18/0x20 x64_sys_call+0x14a0/0x2390 do_syscall_64+0xdd/0x640 ? count_memcg_events+0xea/0x240 ? handle_mm_fault+0x1ec/0x2f0 (cherry picked from commit 1ae415a6eefe5004954a1d352b1718faca8844ef)

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

drivers/gpu/drm/xe/xe_migrate.c
drivers/gpu/drm/xe/xe_migrate.h
drivers/gpu/drm/xe/xe_sriov_vf_ccs.c

What this is: INTEL DRM XE DRIVER (Lunar Lake and newer)MAINTAINERS section matched on drivers/gpu/drm/xe/ · intel-xe@lists.freedesktop.org · Supported
Kernel module: xe

Check it on the machine

grep -w CONFIG_DRM_XE /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

lsmod | grep -w xe

Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.

Show whether Debian builds this, per release

Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed. The build rule could not be established for 1 release, so nothing is claimed about those.

bookworm?
trixieMnot built on amd64/cloud-amd64, arm64/arm64-16k, arm64/cloud-arm64, armel/rpi, ppc64el/powerpc64le-64k, s390x/s390x
forky, sidMnot built on amd64/cloud-amd64, arm64/arm64-16k, arm64/cloud-arm64, loong64/loong64, ppc64el/powerpc64le-64k, s390x/s390x

?: not established - no Makefile entry for the affected file
M: a module where it is built at all; some flavours do not build it

Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.

Build switch: CONFIG_DRM_XE

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Debian tracker CVE record NVD kernel CNA record

Signals

Published: 2026-08-10 (2 months ago)source
CVSS: 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it
Attack vector: local (AV:L)source
EPSS: 0.17%, higher than 6.3% of all CVEssource
CISA KEV: not listedthe KEV catalogue
Debian urgency: unimportantsource
Subsystem: drivers/gpu

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
6.18	6.18.57	0c07e046e639
6.18	7.1.6	523ed2831ee5
6.18	7.2	4c92afb4c143

Why the CNA scored it this way

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local: The path is reached through the local DRM device (/dev/dri/renderD*) — GEM object creation/mmap and process teardown driving TTM BO destruction; no network or remote input is involved.
AC:LAttack complexity, low: No race must be won: a local user only needs live CCS-attached BOs when the device is unbound/hot-removed, after which every subsequent BO release deterministically walks the stale pointers, and BO lifetime is fully under the user's control.
PR:LPrivileges required, low: Only ordinary access to the render node is required to create and hold the CCS-attached buffer objects whose destruction triggers the fault; no capability check guards xe_sriov_vf_ccs_detach_bo().
UI:NUser interaction, none: The faulting code runs automatically from the BO release path (exit_mmap/ttm_bo_release) with no action by any other user; the unbind/hot-remove event is an administrative or host-side operation, not victim interaction.
S:UScope, unchanged: The freed objects and the resulting corruption all belong to the same kernel within the VF guest; no VM, IOMMU or sandbox boundary is crossed.
C:HConfidentiality impact, high: After unbind, ctx->mig_q, pool->bo/shadow and pool->cpu_addr are dangling devm-freed objects that are read (xe_mem_pool_swap_shadow_locked, xe_map_memcpy_to from pool->cpu_addr), so reallocated kernel memory can be read and its contents propagated, giving a use-after-free disclosure primitive.
I:HIntegrity impact, high: The same path writes through the stale mappings — memset(cs, MI_NOOP, bb->sa_node.size), xe_map_wr into the freed LRC BO vmap and a memcpy into the freed shadow BO — so freed memory that may already be reused is overwritten, a use-after-free write primitive.
A:HAvailability impact, high: The reported and reproducible outcome is a kernel NULL pointer dereference oops in xe_sriov_vf_ccs_rw_update_bb_addr() during process exit, killing the task in kernel context and destabilizing the machine.