CVE-2025-68802: drm/xe: Limit num_syncs to prevent oversized allocations

Published Jan 13, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

drm/xe: Limit numsyncs to prevent oversized allocations

The exec and vmbind ioctl allow userspace to specify an arbitrary numsyncs value. Without bounds checking, a very large numsyncs can force an excessively large allocation, leading to kernel warnings from the page allocator as below.

Introduce DRMXEMAXSYNCS (set to 1024) and reject any request exceeding this limit.

" ------------[ cut here ]------------ WARNING: CPU: 0 PID: 1217 at mm/pagealloc.c:5124 allocfrozenpagesnoprof+0x2f8/0x2180 mm/pagealloc.c:5124 ... Call Trace: <TASK> allocpagesmpol+0xe4/0x330 mm/mempolicy.c:2416 kmalloclargenode+0xd8/0x110 mm/slub.c:4317 kmalloclargenodenoprof+0x18/0xe0 mm/slub.c:4348 dokmallocnode mm/slub.c:4364 [inline] kmallocnoprof+0x3d4/0x4b0 mm/slub.c:4388 kmallocnoprof include/linux/slab.h:909 [inline] kmallocarraynoprof include/linux/slab.h:948 [inline] xeexecioctl+0xa47/0x1e70 drivers/gpu/drm/xe/xeexec.c:158 drmioctlkernel+0x1f1/0x3e0 drivers/gpu/drm/drmioctl.c:797 drmioctl+0x5e7/0xc50 drivers/gpu/drm/drmioctl.c:894 xedrmioctl+0x10b/0x170 drivers/gpu/drm/xe/xedevice.c:224 vfsioctl fs/ioctl.c:51 [inline] dosysioctl fs/ioctl.c:598 [inline] sesysioctl fs/ioctl.c:584 [inline] x64sysioctl+0x18b/0x210 fs/ioctl.c:584 dosyscallx64 arch/x86/entry/syscall64.c:63 [inline] dosyscall64+0xbb/0x380 arch/x86/entry/syscall64.c:94 entrySYSCALL64afterhwframe+0x77/0x7f ... "

v2: Add "Reported-by" and Cc stable kernels. v3: Change XEMAXSYNCS from 64 to 1024. (Matt & Ashutosh) v4: s/XEMAXSYNCS/DRMXEMAXSYNCS/ (Matt) v5: Do the check at the top of the exec func. (Matt)

(cherry picked from commit b07bac9bd708ec468cd1b8a5fe70ae2ac9b0a11c)

Affected Software

152 affected componentsFixes available
Linux Linux kernel
ubuntu/linux-hwe-edge*
ubuntu/linux-aws-5.0*
ubuntu/linux-aws-5.3*
ubuntu/linux-azure*
ubuntu/linux-azure-5.3*
ubuntu/linux-azure-edge*
ubuntu/linux-gcp*
ubuntu/linux-gcp-5.3*
ubuntu/linux-gke-4.15*
ubuntu/linux-gke-5.4*
ubuntu/linux-gkeop-5.4*
ubuntu/linux-hwe*
ubuntu/linux-hwe-edge*
ubuntu/linux-oem*
ubuntu/linux-oracle-5.0*
ubuntu/linux-oracle-5.3*
ubuntu/linux-aws-5.11*
ubuntu/linux-aws-5.13*
ubuntu/linux-aws-5.8*
ubuntu/linux-azure-5.11*
ubuntu/linux-azure-5.13*
ubuntu/linux-azure-5.8*
ubuntu/linux-azure-fde*
ubuntu/linux-gcp-5.11*
ubuntu/linux-gcp-5.13*
ubuntu/linux-gcp-5.8*
ubuntu/linux-gke*
ubuntu/linux-gke-5.15*
ubuntu/linux-gkeop*
ubuntu/linux-gkeop-5.15*
ubuntu/linux-hwe-5.11*
ubuntu/linux-hwe-5.13*
ubuntu/linux-hwe-5.8*
ubuntu/linux-intel-5.13*
ubuntu/linux-oem-5.10*
ubuntu/linux-oem-5.13*
ubuntu/linux-oem-5.6*
ubuntu/linux-oracle-5.11*
ubuntu/linux-oracle-5.13*
ubuntu/linux-oracle-5.8*
ubuntu/linux-raspi2*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.11*
ubuntu/linux-riscv-5.8*
ubuntu/linux-allwinner-5.19*
ubuntu/linux-aws-5.19*
ubuntu/linux-aws-6.2*
ubuntu/linux-aws-6.5*
ubuntu/linux-aws-6.8*
ubuntu/linux-azure-5.19*
ubuntu/linux-azure-6.2*
ubuntu/linux-azure-6.5*
ubuntu/linux-azure-6.8*
ubuntu/linux-azure-fde-5.19*
ubuntu/linux-azure-fde-6.2*
ubuntu/linux-azure-fde-6.8*
ubuntu/linux-gcp-5.19*
ubuntu/linux-gcp-6.2*
ubuntu/linux-gcp-6.5*
ubuntu/linux-gcp-6.8*
ubuntu/linux-hwe-5.19*
ubuntu/linux-hwe-6.2*
ubuntu/linux-hwe-6.5*
ubuntu/linux-ibm-6.8*
ubuntu/linux-intel-iot-realtime*
ubuntu/linux-lowlatency-hwe-5.19*
ubuntu/linux-lowlatency-hwe-6.2*
ubuntu/linux-lowlatency-hwe-6.5*
ubuntu/linux-lowlatency-hwe-6.8*
ubuntu/linux-nvidia-6.2*
ubuntu/linux-nvidia-6.5*
ubuntu/linux-nvidia-6.8*
ubuntu/linux-oem-5.17*
ubuntu/linux-oem-6.0*
ubuntu/linux-oem-6.1*
ubuntu/linux-oem-6.5*
ubuntu/linux-oracle-6.5*
ubuntu/linux-oracle-6.8*
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.19*
ubuntu/linux-riscv-6.5*
ubuntu/linux-riscv-6.8*
ubuntu/linux-starfive-5.19*
ubuntu/linux-starfive-6.2*
ubuntu/linux-starfive-6.5*
ubuntu/linux-realtime-6.8*
ubuntu/linux*
ubuntu/linux-aws*
ubuntu/linux-aws-6.14*
ubuntu/linux-aws-6.17<6.17.0-1012.12~24.04.1
6.17.0-1012.12~24.04.1
ubuntu/linux-azure*
ubuntu/linux-azure-6.11*
ubuntu/linux-azure-6.14*
ubuntu/linux-azure-6.17<6.17.0-1013.13~24.04.1
6.17.0-1013.13~24.04.1
ubuntu/linux-azure-fde*
ubuntu/linux-azure-fde-6.14*
ubuntu/linux-azure-fde-6.17*
ubuntu/linux-azure-nvidia*
ubuntu/linux-azure-nvidia-6.14*
ubuntu/linux-gcp*
ubuntu/linux-gcp-6.11*
ubuntu/linux-gcp-6.14*
ubuntu/linux-gcp-6.17<6.17.0-1012.12~24.04.1
6.17.0-1012.12~24.04.1
ubuntu/linux-gke*
ubuntu/linux-gkeop*
ubuntu/linux-hwe-6.11*
ubuntu/linux-hwe-6.14*
ubuntu/linux-hwe-6.17<6.17.0-22.22~24.04.1
6.17.0-22.22~24.04.1
ubuntu/linux-ibm*
ubuntu/linux-lowlatency*
ubuntu/linux-lowlatency-hwe-6.11*
ubuntu/linux-nvidia*
ubuntu/linux-nvidia-6.11*
ubuntu/linux-nvidia-6.17<6.17.0-1018.18
6.17.0-1018.18
ubuntu/linux-nvidia-lowlatency*
ubuntu/linux-nvidia-tegra*
ubuntu/linux-oem-6.11*
ubuntu/linux-oem-6.14*
ubuntu/linux-oem-6.17<6.17.0-1020.20
6.17.0-1020.20
ubuntu/linux-oem-6.8*
ubuntu/linux-oracle*
ubuntu/linux-oracle-6.14*
ubuntu/linux-oracle-6.17<6.17.0-1011.11~24.04.1
6.17.0-1011.11~24.04.1
ubuntu/linux-raspi*
ubuntu/linux-raspi-realtime*
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-riscv-6.14*
ubuntu/linux-riscv-6.17<6.17.0-22.22.1~24.04.1
6.17.0-22.22.1~24.04.1
ubuntu/linux-vmware*
ubuntu/linux-xilinx*
ubuntu/linux-bluefield*
ubuntu/linux-raspi-realtime*
ubuntu/linux-realtime*
ubuntu/linux-realtime-6.14*
ubuntu/linux-realtime-6.17<6.17.0-1010.11~24.04.1
6.17.0-1010.11~24.04.1
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux<6.17.0-22.22
6.17.0-22.22
ubuntu/linux-aws<6.17.0-1012.12
6.17.0-1012.12
ubuntu/linux-azure<6.17.0-1013.13
6.17.0-1013.13
ubuntu/linux-azure-fde*
ubuntu/linux-gcp<6.17.0-1012.12
6.17.0-1012.12
ubuntu/linux-oracle<6.17.0-1011.11
6.17.0-1011.11
ubuntu/linux-raspi<6.17.0-1013.13
6.17.0-1013.13
ubuntu/linux-realtime<6.17.0-1010.11
6.17.0-1010.11
ubuntu/linux-riscv<6.17.0-22.22.1
6.17.0-22.22.1
debian/linux
6.1.176-16.1.190-16.12.107-16.12.115-27.2.12-17.2.15-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
  2. Upgrade

    Upgrade ubuntu/linux-aws-6.17 to a version that resolves this vulnerability.

    Fixed in 6.17.0-1012.12~24.04.1
  3. Upgrade

    Upgrade ubuntu/linux-azure-6.17 to a version that resolves this vulnerability.

    Fixed in 6.17.0-1013.13~24.04.1
  4. Upgrade

    Upgrade ubuntu/linux-gcp-6.17 to a version that resolves this vulnerability.

    Fixed in 6.17.0-1012.12~24.04.1
  5. Upgrade

    Upgrade ubuntu/linux-hwe-6.17 to a version that resolves this vulnerability.

    Fixed in 6.17.0-22.22~24.04.1
  6. Upgrade

    Upgrade ubuntu/linux-nvidia-6.17 to a version that resolves this vulnerability.

    Fixed in 6.17.0-1018.18
  7. Upgrade

    Upgrade ubuntu/linux-oem-6.17 to a version that resolves this vulnerability.

    Fixed in 6.17.0-1020.20
  8. Upgrade

    Upgrade ubuntu/linux-oracle-6.17 to a version that resolves this vulnerability.

    Fixed in 6.17.0-1011.11~24.04.1
  9. Upgrade

    Upgrade ubuntu/linux-riscv-6.17 to a version that resolves this vulnerability.

    Fixed in 6.17.0-22.22.1~24.04.1
  10. Upgrade

    Upgrade ubuntu/linux-realtime-6.17 to a version that resolves this vulnerability.

    Fixed in 6.17.0-1010.11~24.04.1
  11. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 6.17.0-22.22
  12. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 6.17.0-1012.12
  13. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 6.17.0-1013.13
  14. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 6.17.0-1012.12
  15. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 6.17.0-1011.11
  16. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 6.17.0-1013.13
  17. Upgrade

    Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.

    Fixed in 6.17.0-1010.11
  18. Upgrade

    Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.

    Fixed in 6.17.0-22.22.1
  19. Upgrade

    Upgrade Linux kernel to a version that resolves this vulnerability.

    Patch b07bac9bd708ec468cd1b8a5fe70ae2ac9b0a11c

Event History

Jan 13, 2026
CVE Published
via MITRE·03:29 PM
Data Sourced
via MITRE·03:29 PM
Description
Data Sourced
via OSV·04:16 PM
DescriptionSeverityAffected Software
Data Sourced
via NVD·04:16 PM
Description

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

1

What is the severity of CVE-2025-68802?

CVE-2025-68802 is classified as a high severity vulnerability due to its potential to cause oversized memory allocations.

2

How does CVE-2025-68802 affect the Linux kernel?

CVE-2025-68802 allows userspace to specify an arbitrary num_syncs value which leads to a lack of bounds checking and potential resource exhaustion.

3

How do I fix CVE-2025-68802?

To fix CVE-2025-68802, update your Linux kernel to the latest patched version where this vulnerability has been addressed.

4

Which versions of the Linux kernel are affected by CVE-2025-68802?

CVE-2025-68802 affects various versions of the Linux kernel that do not implement limits on the num_syncs parameter in affected ioctls.

5

Is there a workaround for CVE-2025-68802?

Currently, the best workaround for CVE-2025-68802 is to apply the patch or update the kernel version to mitigate the risks associated.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203