CVE-2026-68274 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/xe/guc: Fix buffer overflow in steered register list allocation
The size calculation for the steered register extarray uses only the geometry DSS mask (g_dss_mask) to determine the number of entries to allocate:
total = bitmap_weight(gt->fuse_topo.g_dss_mask, ...) * steer_reg_num;
However, the filling loop uses for_each_dss_steering(), which iterates over for_each_dss(), defined as the union of g_dss_mask and c_dss_mask (geometry + compute DSS). On platforms with compute-only DSS bits, the loop writes past the allocated buffer, corrupting adjacent slab objects.
This manifests as list_del corruption and SLUB redzone overwrites during drm_managed_release on device unbind, since the overflow corrupts the drmres list_head of neighboring allocations.
Fix by computing the allocation size using the union of both DSS masks, matching the iteration pattern of for_each_dss_steering().
-- v2: - use bitmap_weighted_or() (Zhanjun)
(cherry picked from commit 0a78a44f4901aa6c9263e66be7fce02282f1109f)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability exists within the Intel Graphics Unified Command (GUC) subsystem of the Linux kernel's Direct Rendering Manager framework, specifically in the xe driver responsible for managing Intel Xe graphics hardware. The issue stems from a buffer overflow condition that occurs during memory allocation and subsequent data population within the steered register list functionality. The flaw manifests when the system attempts to manage graphics resources during device unbind operations, creating potential for system instability and security implications.
The technical root cause lies in an inconsistent sizing calculation that fails to account for all possible DSS (Display Subsystem) entries that may be processed. The allocation routine calculates buffer size using only the geometry DSS mask (g_dss_mask) which represents display processing units responsible for graphics rendering, while the actual data filling operation iterates over a broader set of DSS entries through for_each_dss_steering() macro. This iteration pattern encompasses both geometry and compute DSS masks (g_dss_mask union c_dss_mask), where compute DSS bits represent dedicated compute processing units that may be present on certain hardware platforms but were not accounted for in the initial allocation size calculation.
This mismatch creates a classic buffer overflow scenario where the filling loop writes data beyond the allocated memory boundaries, corrupting adjacent memory objects within the SLUB (SLAB Allocator) memory management system. The corruption specifically targets the list_head structures used by the drmres (Direct Rendering Manager resource) framework, causing fundamental data structure corruption that manifests as list_del corruption during device unbind operations. The SLUB redzone overwrites indicate that memory corruption extends beyond the immediate buffer boundaries into adjacent allocated objects, potentially affecting other kernel data structures and creating opportunities for further exploitation.
The vulnerability directly relates to CWE-121 which describes stack-based buffer overflow conditions, though this particular case involves heap allocation issues within kernel memory management. The operational impact spans from system instability and potential denial of service conditions to more severe consequences if exploited in a manner that could leverage the corrupted data structures for privilege escalation or information disclosure attacks. The issue affects systems running Linux kernels with Intel Xe graphics support, particularly those utilizing platforms that implement compute-only DSS bits.
The fix implements a corrected allocation strategy that properly accounts for all DSS entries by computing the buffer size using bitmap_weighted_or() function to calculate the union of both geometry and compute DSS masks. This ensures that the allocated buffer size exactly matches the iteration pattern used during data population, eliminating the overflow condition through proper memory boundary management. The solution aligns with ATT&CK technique T1068 which involves exploitation of system privileges and memory corruption vulnerabilities, though this particular fix addresses a denial of service rather than privilege escalation. The cherry-picked commit represents a targeted kernel security patch that resolves the inconsistency between memory allocation and data processing boundaries in the graphics subsystem's resource management code.