What is the CVSS score of CVE-2026-68265?

CVE-2026-68265 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-68265?

Intel Xe GPU drivers on Linux are vulnerable to kernel memory access and system crash attacks by local users. No public exploit identified at time of analysis.. A patch is available.

How to fix or mitigate CVE-2026-68265?

Within 24 hours, audit all Linux systems to identify those with Intel Xe GPU drivers and document driver versions. Within 7 days, obtain the Intel Xe GPU driver patch available per Intel's security advisory and validate in non-production environments. Complete deployment across all affected production systems within 30 days, prioritizing systems handling sensitive data or supporting business-critical operations.

Linux Kernel CVE-2026-68265

EUVD-2026-55366 HIGH

2026-08-10 Linux

GHSA-298g-42h7-52m6

Buffer Overflow Linux Intel

7.3

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.3 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

vuln.today AI

7.3 HIGH

Local vector confirmed by DRM ioctl requirement; PR:L reflects render group membership needed; C:H and A:H for kernel memory exposure and crash potential respectively.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 14, 2026 - 01:32 vuln.today

CVSS changed

Aug 13, 2026 - 23:37 NVD

7.3 (HIGH)

Patch available

Aug 10, 2026 - 14:18 EUVD

CVE Published

Aug 10, 2026 - 12:01 cve.org

HIGH 7.3

CVE Published

Aug 10, 2026 - 12:01 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/vm: Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOC

When prefetch region is DRM_XE_CONSULT_MEM_ADVISE_PREF_LOC for a BO VMA, the code used it as an index into region_to_mem_type[], causing an out-of-bounds access since the value is -1.

Resolve the preferred location for BO VMAs directly: local VRAM on dGFX (using the BO's tile placement) or system memory on iGPU.

Discovered using AI-assisted static analysis confirmed by Intel Product Security.

v2: -Fix null dereference

(cherry picked from commit d9a4906ac03be9f6ed3f3b45c56c866b867fd75b)

AnalysisAI

Out-of-bounds kernel memory access in the Linux drm/xe Intel GPU driver allows a local low-privileged user to read sensitive kernel memory, cause a kernel panic, or potentially corrupt kernel state. The flaw exists in the BO (buffer object) prefetch path of the Intel Xe GPU subsystem, where DRM_XE_CONSULT_MEM_ADVISE_PREF_LOC (value -1) is incorrectly used as an array index into region_to_mem_type[], accessing memory before the array's base address. Discovered via AI-assisted static analysis confirmed by Intel Product Security; no public exploit or CISA KEV listing identified at time of analysis.

Technical ContextAI

The vulnerability resides in drm/xe/vm, the virtual memory management subsystem of the Intel Xe DRM (Direct Rendering Manager) kernel driver, which handles Intel Arc discrete GPUs and Xe integrated graphics (Meteor Lake and newer). The DRM_XE_CONSULT_MEM_ADVISE_PREF_LOC constant has a value of -1, representing a symbolic 'consult the memory advice' preferred location for buffer object VMAs. A code path that performs BO prefetching incorrectly treated this symbolic constant as a direct index into the region_to_mem_type[] array, causing an out-of-bounds array access at offset -1 relative to the array base. While no CWE was formally assigned, the root cause class is CWE-787 (Out-of-Bounds Write) or CWE-125 (Out-of-Bounds Read) - characteristic of using an unchecked sentinel value as an array subscript. The fix resolves the preferred location by directly inspecting the BO's actual placement context: local VRAM on discrete GPUs (using tile placement) or system memory on integrated GPUs, rather than treating the symbolic value as a numeric index. The upstream fix is cherry-picked commit d9a4906ac03be9f6ed3f3b45c56c866b867fd75b, with a v2 also addressing a null dereference. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*

RemediationAI

The primary fix is to upgrade to a patched Linux kernel release: version 6.18.44, 7.1.6, or 7.2-rc4 or later, all of which contain the upstream fix cherry-picked from commit d9a4906ac03be9f6ed3f3b45c56c866b867fd75b. Distribution kernel packages (Debian, Ubuntu, RHEL, Fedora, SUSE) that ship the drm/xe driver should be updated as patches flow into stable channels. Fix commits are referenced at https://git.kernel.org/stable/c/d256dac008d1d9e6378aa1a5454e89a8292d174c (6.18 branch), https://git.kernel.org/stable/c/c4affa4e8bc8086b4d3e8d6cf1055a624f813d72, and https://git.kernel.org/stable/c/7bc597ce74bab4153b2009c92eccf889e9d74044. As a compensating control where patching is not immediately feasible, administrators can block untrusted local users from GPU device access by restricting permissions on /dev/dri/renderD* nodes (e.g., removing render group membership for untrusted accounts), which prevents unprivileged DRM ioctl invocation - the trade-off is loss of GPU access for those accounts. Disabling the xe kernel module (modprobe -r xe) is a more disruptive option that removes the attack surface entirely at the cost of Intel Xe GPU functionality.

More in Intel

View all

CVE-2021-44228 CRITICAL Act Now POC

10.0 Dec 10

Apache Log4j2 contains a critical JNDI injection vulnerability known as 'Log4Shell' that allows unauthenticated remote c

CVE-2017-5689 CRITICAL Act Now POC

9.8 May 02

An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Mana

CVE-2012-5958 CRITICAL Act Now POC

10.0 Jan 31