CVE-2026-68264: drm/xe/pt: Reset current_op in xe_pt_update_ops_init()

Published Aug 10, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/pt: Reset currentop in xeptupdateopsinit()

xeptupdateopsinit() fails to reset currentop to 0. On the vmbind path, opsexecute() calls xeptupdateopsprepare() inside the xevalidationguard() / drmexecuntilalllocked() loop. When that loop retries due to lock contention or OOM eviction (drmexecretryoncontention() / xevalidationretryonoom()), xeptupdateopsprepare() runs again on the same vops, and each call to bindopprepare() increments currentop without resetting it.

After N retries currentop exceeds the array size allocated by xevmaopsalloc(), causing an out-of-bounds write into SLUB-poisoned memory and a subsequent UAF crash in xemigrateupdatepgtablescpu() when reading the corrupted ptop->bind.

Also reset needssvmlock and needsinvalidation which are derived in the same prepare pass and would otherwise cause wrong migrate ops selection and redundant TLB invalidation on retry.

Fix this by resetting currentop, needssvmlock and needsinvalidation in xeptupdateopsinit().

v2 (Matt): - Add details in commit message. - Add Fixes tag and Cc to stable@vger.kernel.org

(cherry picked from commit 046045543e530605c441063535e7dca0075369a6)

Affected Software

1 affected component

Linux Kernel

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Upgrade
Upgrade debian/linux-6.12 to a version that resolves this vulnerability.
Fixed in 6.12.113-1~deb12u1
Upgrade
Upgrade ubuntu/linux-aws-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1014.14~24.04.1
Upgrade
Upgrade ubuntu/linux-azure-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1017.17~24.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1016.16~24.04.1
Upgrade
Upgrade ubuntu/linux-gcp-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1014.14~24.04.1
Upgrade
Upgrade ubuntu/linux-hwe-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-38.38~24.04.4
Upgrade
Upgrade ubuntu/linux-oracle-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1013.13~24.04.1
Upgrade
Upgrade ubuntu/linux-riscv-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-38.38.1~24.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 7.0.0-38.38
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 7.0.0-1014.14
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 7.0.0-1017.17
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 7.0.0-1016.16
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 7.0.0-1014.14
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 7.0.0-1008.9
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 7.0.0-1015.15
Upgrade
Upgrade ubuntu/linux-oem-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1015.15
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 7.0.0-1013.13
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 7.0.0-38.38.1
Upgrade
Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.
Fixed in 7.0.0-38.38.1
Upgrade
Upgrade Linux kernel to a version that resolves this vulnerability.
Patch 046045543e530605c441063535e7dca0075369a6

Event History

Aug 10, 2026

CVE Published

via MITRE·12:01 PM

Data Sourced

via MITRE·12:01 PM

DescriptionSeverity

Data Sourced

via NVD·01:20 PM

DescriptionSeverity

Parent advisories

This vulnerability appears in the following advisories.

DSA-6466

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-4788-1

Frequently Asked Questions

What is the severity of CVE-2026-68264?

The severity of CVE-2026-68264 is rated as 55.

How do I fix CVE-2026-68264?

To fix CVE-2026-68264, update the Linux kernel to the latest patched version that addresses the vulnerability.

What systems are affected by CVE-2026-68264?

CVE-2026-68264 affects systems running vulnerable versions of the Linux kernel.

What type of vulnerability is CVE-2026-68264?

CVE-2026-68264 is a kernel vulnerability related to improper handling of the current_op variable in the DRM subsystem.

When was CVE-2026-68264 published?

CVE-2026-68264 was published on August 10, 2026.