CVE-2026-68264 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/xe/pt: Reset current_op in xe_pt_update_ops_init()
xe_pt_update_ops_init() fails to reset current_op to 0. On the vm_bind path, ops_execute() calls xe_pt_update_ops_prepare() inside the xe_validation_guard() / drm_exec_until_all_locked() loop. When that loop retries due to lock contention or OOM eviction (drm_exec_retry_on_contention() / xe_validation_retry_on_oom()), xe_pt_update_ops_prepare() runs again on the same vops, and each call to bind_op_prepare() increments current_op without resetting it.
After N retries current_op exceeds the array size allocated by xe_vma_ops_alloc(), causing an out-of-bounds write into SLUB-poisoned memory and a subsequent UAF crash in xe_migrate_update_pgtables_cpu() when reading the corrupted pt_op->bind.
Also reset needs_svm_lock and needs_invalidation which are derived in the same prepare pass and would otherwise cause wrong migrate ops selection and redundant TLB invalidation on retry.
Fix this by resetting current_op, needs_svm_lock and needs_invalidation in xe_pt_update_ops_init().
v2 (Matt): - Add details in commit message. - Add Fixes tag and Cc to [email protected]
(cherry picked from commit 046045543e530605c441063535e7dca0075369a6)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability resides within the Intel Xeon Edge graphics driver implementation in the Linux kernel, specifically affecting the page table management subsystem. This issue manifests during virtual memory address binding operations where the driver fails to properly initialize state variables before executing validation loops. The root cause stems from insufficient state reset in the xe_pt_update_ops_init() function which governs preparation of page table update operations.
The technical flaw occurs when processing vm_bind requests through the drm_exec_until_all_locked() execution loop. During lock contention or out-of-memory eviction scenarios, the loop employs drm_exec_retry_on_contention() and xe_validation_retry_on_oom() mechanisms to retry operations. However, the xe_pt_update_ops_prepare() function executes repeatedly on the same validation operations without resetting critical state variables including current_op, needs_svm_lock, and needs_invalidation.
This improper state management leads to a predictable arithmetic overflow where each iteration of bind_op_prepare() increments current_op beyond its allocated array bounds. The xe_vma_ops_alloc() function pre-allocates memory for page table operations but cannot accommodate the unbounded increment of current_op, resulting in out-of-bounds memory writes into SLUB-poisoned kernel memory regions. These memory corruptions ultimately trigger use-after-free conditions when xe_migrate_update_pgtables_cpu() attempts to read corrupted pt_op->bind structures.
The operational impact spans system stability and potential privilege escalation scenarios, as the vulnerability enables arbitrary memory corruption through controlled input data. The out-of-bounds write directly targets kernel heap metadata managed by SLUB allocator, creating opportunities for information disclosure or system compromise. This vulnerability aligns with CWE-121 stack-based buffer overflow and CWE-787 out-of-bounds write categories, while the execution pattern reflects ATT&CK technique T1059 command and scripting interpreter for privilege escalation and T1068 local privilege escalation via kernel exploits.
Mitigation strategies require immediate application of the patch that resets current_op, needs_svm_lock, and needs_invalidation variables to zero within xe_pt_update_ops_init(). This ensures proper initialization before each execution loop iteration. Additionally, system administrators should prioritize kernel updates and monitor for potential exploitation attempts through memory corruption analysis tools. The fix addresses the core issue by preventing state leakage between retry iterations, maintaining consistent operation counts and ensuring proper validation of page table operations during concurrent access scenarios.