CVE-2026-68264: drm/xe/pt: Reset current_op in xe_pt_update_ops_init()
In the Linux kernel, the following vulnerability has been resolved:
drm/xe/pt: Reset currentop in xeptupdateopsinit()
xeptupdateopsinit() fails to reset currentop to 0. On the vmbind path, opsexecute() calls xeptupdateopsprepare() inside the xevalidationguard() / drmexecuntilalllocked() loop. When that loop retries due to lock contention or OOM eviction (drmexecretryoncontention() / xevalidationretryonoom()), xeptupdateopsprepare() runs again on the same vops, and each call to bindopprepare() increments currentop without resetting it.
After N retries currentop exceeds the array size allocated by xevmaopsalloc(), causing an out-of-bounds write into SLUB-poisoned memory and a subsequent UAF crash in xemigrateupdatepgtablescpu() when reading the corrupted ptop->bind.
Also reset needssvmlock and needsinvalidation which are derived in the same prepare pass and would otherwise cause wrong migrate ops selection and redundant TLB invalidation on retry.
Fix this by resetting currentop, needssvmlock and needsinvalidation in xeptupdateopsinit().
v2 (Matt): - Add details in commit message. - Add Fixes tag and Cc to stable@vger.kernel.org
(cherry picked from commit 046045543e530605c441063535e7dca0075369a6)
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68264?
The severity of CVE-2026-68264 is rated as 55.
How do I fix CVE-2026-68264?
To fix CVE-2026-68264, update the Linux kernel to the latest patched version that addresses the vulnerability.
What systems are affected by CVE-2026-68264?
CVE-2026-68264 affects systems running vulnerable versions of the Linux kernel.
What type of vulnerability is CVE-2026-68264?
CVE-2026-68264 is a kernel vulnerability related to improper handling of the current_op variable in the DRM subsystem.
When was CVE-2026-68264 published?
CVE-2026-68264 was published on August 10, 2026.