What is the CVSS score of CVE-2026-68305?

CVE-2026-68305 has a contested CVSS base score of 7.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-68305?

CVE-2026-68305 is a Linux kernel denial-of-service vulnerability in Intel Xe GPU SR-IOV virtual function drivers allowing unauthenticated local users to crash systems.. A patch is available.

How to fix or mitigate CVE-2026-68305?

Within 24 hours, identify systems running affected Linux kernels with Intel Xe GPU SR-IOV virtual function drivers enabled. Within 7 days, deploy the patch available per vendor advisory through your Linux distribution's security update channels across all affected systems. Within 30 days, verify patch deployment completion and validate system stability, prioritizing systems serving multiple local users or with high availability requirements.

Linux Kernel CVE-2026-68305

EUVD-2026-55406 HIGH

2026-08-10 Linux

GHSA-qfm9-4w8r-pq56

Denial Of Service Linux

High

Disputed · 7.8 Vendor: Linux

Severity by source

Sources disagree (Low–High)

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

AC:H reflects the timing-dependent race between device unbind and BO destruction; PR:L for required local GPU device access; C/I/A:H for kernel-level NULL deref potential.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 14, 2026 - 03:13 vuln.today

CVSS changed

Aug 13, 2026 - 23:37 NVD

7.8 (HIGH)

Patch available

Aug 10, 2026 - 14:18 EUVD

CVE Published

Aug 10, 2026 - 12:02 cve.org

HIGH 7.8

CVE Published

Aug 10, 2026 - 12:02 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers

CCS read/write buffers are freed during BO destruction. In some cases, BOs may be destroyed after the device is unbound but while the DRM structure remains valid, leading to NULL pointer dereferences when accessing device resources.

BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 0 UID: 0 PID: 9376 Comm: xe_pat Not tainted 7.2.0-rc2+ #1 PREEMPT(lazy) RIP: 0010:xe_sriov_vf_ccs_rw_update_bb_addr+0x4d/0xa0 [xe] RSP: 0018:ffffcf304110b9c8 EFLAGS: 00010246 RAX: ffff8a85c38a0a00 RBX: 00000000810ef000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8a85c39c1888 RBP: ffffcf304110b9e8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff8a85c39c1888 R13: 0000000000000000 R14: ffff8a85c39b4f28 R15: ffff8a85c3885000 FS: 0000000000000000(0000) GS:ffff8a878b809000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000010314a002 CR4: 0000000000772ef0 PKRU: 55555554 Call Trace: <TASK> xe_migrate_ccs_rw_copy_clear+0x98/0x120 [xe] xe_sriov_vf_ccs_detach_bo+0x2c/0x60 [xe] xe_ttm_bo_delete_mem_notify+0xc8/0xe0 [xe] ttm_bo_cleanup_memtype_use+0x26/0x80 [ttm] ttm_bo_release+0x29e/0x2d0 [ttm] ttm_bo_fini+0x39/0x70 [ttm] xe_gem_object_free+0x1f/0x30 [xe] drm_gem_object_free+0x1d/0x40 ttm_bo_vm_close+0x5f/0x90 [ttm] remove_vma+0x2c/0x70 tear_down_vmas+0x63/0xf0 exit_mmap+0x20d/0x3f0 __mmput+0x45/0x170 mmput+0x31/0x40 do_exit+0x2ba/0xac0 do_group_exit+0x2d/0xb0 __x64_sys_exit_group+0x18/0x20 x64_sys_call+0x14a0/0x2390 do_syscall_64+0xdd/0x640 ? count_memcg_events+0xea/0x240 ? handle_mm_fault+0x1ec/0x2f0

(cherry picked from commit 1ae415a6eefe5004954a1d352b1718faca8844ef)

AnalysisAI

NULL pointer dereference in the Linux kernel's Intel Xe GPU SR-IOV virtual function (VF) driver allows a local user to crash the kernel during buffer object (BO) teardown. The flaw is triggered when CCS (Color Compression Surface) read/write buffers are freed after the device is unbound but while the DRM structure remains live, causing xe_sriov_vf_ccs_rw_update_bb_addr to dereference a NULL device pointer during process exit. CVSS rates this 7.8 (C:H/I:H/A:H) reflecting worst-case kernel-level impact, though practical exploitation is constrained by hardware and configuration prerequisites; EPSS is 0.16% (6th percentile) and no active exploitation is confirmed.

Technical ContextAI

The vulnerability resides in the drm/xe subsystem - the Linux upstream driver for Intel Xe architecture GPUs (Arc and Data Center GPU Flex/Max series). SR-IOV (Single Root I/O Virtualization) allows a physical GPU to present multiple virtual functions to VMs or containers. CCS (Color Compression Surface) buffers are GPU memory objects managed via TTM (Translation Table Maps), the kernel's GPU memory manager. During process exit, the kernel tears down VMAs, which triggers TTM BO release via ttm_bo_release → ttm_bo_fini → xe_gem_object_free, ultimately calling xe_sriov_vf_ccs_detach_bo. If the physical device has already been unbound at this point, the device pointer accessed inside xe_sriov_vf_ccs_rw_update_bb_addr is NULL, causing an Oops. The fix adds drm_dev guards to gate the detach path. The root cause class is CWE-476 (NULL Pointer Dereference), though NVD has not formally assigned a CWE. The CPE is cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

Apply the upstream stable kernel patches available at https://git.kernel.org/stable/c/523ed2831ee55b2a1edabdea96781651f9df9685 (targeting the 7.2 stable branch) and https://git.kernel.org/stable/c/4c92afb4c143526d340545ca581e88e6952ea511 (targeting the 7.1.x branch, confirmed fix for 7.1.6). Distributions shipping kernel 6.18 or 7.x with the Xe driver should await or request backport patches. As a compensating control where patching is not immediately feasible, disabling SR-IOV VF allocation on Intel Xe GPU hardware eliminates the vulnerable code path entirely - note that this removes VM/container GPU sharing capability. Systems without Intel Xe GPU hardware require no action.

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-68305 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-68305

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Denial Of Service

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code