CVE-2026-68305 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers
CCS read/write buffers are freed during BO destruction. In some cases, BOs may be destroyed after the device is unbound but while the DRM structure remains valid, leading to NULL pointer dereferences when accessing device resources.
BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI
CPU: 0 UID: 0 PID: 9376 Comm: xe_pat Not tainted 7.2.0-rc2+ #1 PREEMPT(lazy) RIP: 0010:xe_sriov_vf_ccs_rw_update_bb_addr+0x4d/0xa0 [xe]
RSP: 0018:ffffcf304110b9c8 EFLAGS: 00010246 RAX: ffff8a85c38a0a00 RBX: 00000000810ef000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8a85c39c1888 RBP: ffffcf304110b9e8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff8a85c39c1888 R13: 0000000000000000 R14: ffff8a85c39b4f28 R15: ffff8a85c3885000 FS: 0000000000000000(0000) GS:ffff8a878b809000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000010314a002 CR4: 0000000000772ef0 PKRU: 55555554 Call Trace: <TASK> xe_migrate_ccs_rw_copy_clear+0x98/0x120 [xe]
xe_sriov_vf_ccs_detach_bo+0x2c/0x60 [xe]
xe_ttm_bo_delete_mem_notify+0xc8/0xe0 [xe]
ttm_bo_cleanup_memtype_use+0x26/0x80 [ttm]
ttm_bo_release+0x29e/0x2d0 [ttm]
ttm_bo_fini+0x39/0x70 [ttm]
xe_gem_object_free+0x1f/0x30 [xe]
drm_gem_object_free+0x1d/0x40 ttm_bo_vm_close+0x5f/0x90 [ttm]
remove_vma+0x2c/0x70 tear_down_vmas+0x63/0xf0 exit_mmap+0x20d/0x3f0 __mmput+0x45/0x170 mmput+0x31/0x40 do_exit+0x2ba/0xac0 do_group_exit+0x2d/0xb0 __x64_sys_exit_group+0x18/0x20 x64_sys_call+0x14a0/0x2390 do_syscall_64+0xdd/0x640 ? count_memcg_events+0xea/0x240 ? handle_mm_fault+0x1ec/0x2f0
(cherry picked from commit 1ae415a6eefe5004954a1d352b1718faca8844ef)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability exists within the Linux kernel's graphics subsystem, specifically affecting the intel xe driver's handling of virtual function (VF) communication in single root I/O virtualization (SR-IOV) environments. The flaw manifests when CCS (Control and Command Stream) read/write buffers are freed during buffer object destruction operations. When a graphics buffer object is destroyed after the device has been unbound from the system but while the DRM (Direct Rendering Manager) structure remains in memory, the code attempts to access device resources through a NULL pointer reference. This occurs because the driver fails to properly validate whether the underlying device context is still valid before attempting resource cleanup operations.
The technical implementation of this vulnerability stems from inadequate defensive programming practices within the kernel's graphics driver architecture. During normal operation, when a buffer object is destroyed, the driver should verify that all associated device resources remain accessible. However, in certain edge cases involving rapid device unbinding followed by memory cleanup operations, the code path executes without proper device context validation. The stack trace reveals execution flows through xe_sriov_vf_ccs_rw_update_bb_addr which leads to xe_sriov_vf_ccs_detach_bo and eventually to ttm_bo_cleanup_memtype_use where the NULL pointer dereference occurs. This type of vulnerability falls under CWE-476, specifically Null Pointer Dereference, as it involves accessing a memory location that has been set to NULL.
The operational impact of this vulnerability is significant for systems utilizing Intel graphics hardware in virtualized environments. An attacker could potentially exploit this condition to cause system crashes or, more critically, achieve privilege escalation by manipulating the timing of device unbinding and buffer destruction operations. The vulnerability affects systems running kernel versions including 7.2.0-rc2 and earlier releases where the problematic code path has not been patched. In production environments, particularly those using virtualization technologies like SR-IOV for graphics acceleration, this could lead to denial of service conditions or unauthorized access to system resources. The vulnerability aligns with ATT&CK technique T1068 by leveraging kernel memory corruption to potentially gain elevated privileges.
The fix implemented addresses this issue by introducing proper DRM device guards during the detachment of CCS read/write buffers. This ensures that buffer object destruction operations only proceed when the underlying device context remains valid and accessible. The patch modifies the code path to include explicit checks before attempting to access device resources, preventing the NULL pointer dereference condition entirely. This defensive programming approach aligns with secure coding practices recommended by the Linux kernel security team and follows established patterns for handling device state transitions in virtualized graphics environments. The solution prevents arbitrary code execution while maintaining system stability during normal operation and device management scenarios.