Skip to main content

Linux Kernel EUVDEUVD-2026-55365

| CVE-2026-68264 HIGH
2026-08-10 Linux GHSA-3g93-j9xq-65rg
Buffer Overflow Linux
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

AC:H because exploitation requires engineering lock contention or OOM to trigger the retry loop; all other vendor metrics are accurate.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.8 HIGH
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 14, 2026 - 02:05 vuln.today
CVSS changed
Aug 13, 2026 - 23:37 NVD
7.8 (HIGH)
Patch available
Aug 10, 2026 - 14:18 EUVD
CVE Published
Aug 10, 2026 - 12:01 cve.org
HIGH 7.8
CVE Published
Aug 10, 2026 - 12:01 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/pt: Reset current_op in xe_pt_update_ops_init()

xe_pt_update_ops_init() fails to reset current_op to 0. On the vm_bind path, ops_execute() calls xe_pt_update_ops_prepare() inside the xe_validation_guard() / drm_exec_until_all_locked() loop. When that loop retries due to lock contention or OOM eviction (drm_exec_retry_on_contention() / xe_validation_retry_on_oom()), xe_pt_update_ops_prepare() runs again on the same vops, and each call to bind_op_prepare() increments current_op without resetting it.

After N retries current_op exceeds the array size allocated by xe_vma_ops_alloc(), causing an out-of-bounds write into SLUB-poisoned memory and a subsequent UAF crash in xe_migrate_update_pgtables_cpu() when reading the corrupted pt_op->bind.

Also reset needs_svm_lock and needs_invalidation which are derived in the same prepare pass and would otherwise cause wrong migrate ops selection and redundant TLB invalidation on retry.

Fix this by resetting current_op, needs_svm_lock and needs_invalidation in xe_pt_update_ops_init().

v2 (Matt):

  • Add details in commit message.
  • Add Fixes tag and Cc to stable@vger.kernel.org

(cherry picked from commit 046045543e530605c441063535e7dca0075369a6)

AnalysisAI

Out-of-bounds write and use-after-free in the Intel Xe GPU DRM driver (drm/xe/pt) allows a local low-privileged attacker to corrupt kernel heap memory and crash or potentially escalate privileges on systems running affected Linux kernel versions. The flaw exists in xe_pt_update_ops_init(), which fails to reset current_op, needs_svm_lock, and needs_invalidation before each pass, causing unbounded counter growth across drm_exec retry loops triggered by lock contention or OOM eviction. No public exploit code exists and EPSS is extremely low (0.18%), though the memory corruption primitive is structurally serious.

Technical ContextAI

The vulnerability resides in the Intel Xe GPU DRM subsystem's page table update path (drm/xe/pt). On the vm_bind path, ops_execute() calls xe_pt_update_ops_prepare() inside a drm_exec_until_all_locked() loop, which retries on lock contention (drm_exec_retry_on_contention()) or OOM eviction (xe_validation_retry_on_oom()). Each retry calls bind_op_prepare(), incrementing the current_op counter without resetting it because xe_pt_update_ops_init() omits that reset. After N retries, current_op exceeds the array size allocated by xe_vma_ops_alloc(), producing an out-of-bounds write into SLUB-poisoned memory. This corrupts pt_op->bind, which is subsequently read by xe_migrate_update_pgtables_cpu(), triggering a use-after-free crash. The CWE is not formally assigned in the input data, but the root cause class is CWE-787 (Out-of-Bounds Write) compounded by CWE-416 (Use After Free). The affected CPE is cpe:2.3:a:linux:linux across multiple stable branches starting from commit e8babb280b5ef904df54b3a90e5a7e3a9600c4a9.

RemediationAI

The primary fix is to upgrade to a patched Linux kernel version: 6.12.103, 6.18.44, 7.1.6, or 7.2-rc4 and later, depending on the deployed stable series. Upstream patch commits are available at https://git.kernel.org/stable/c/be5c39730ab8f1dfe59983bf7d8e3705541d1fee (6.12 stable), https://git.kernel.org/stable/c/157b1e3384d7d37f59c0c2b2ff2af8f557db1daa, https://git.kernel.org/stable/c/90e4fd331b980259c40118d05b89b0ec514e7c48, and https://git.kernel.org/stable/c/6384271ac1ac0099198d15df79212a19ebdb929d. Where immediate kernel upgrade is not feasible, a compensating control is to unload or blacklist the xe kernel module (modprobe -r xe; echo 'blacklist xe' >> /etc/modprobe.d/blacklist.conf) on systems that do not require Intel Xe GPU functionality. This eliminates the attack surface entirely at the cost of losing Xe GPU support. Restricting local user access to DRM device nodes (/dev/dri/renderD*) via udev rules or group membership is a partial mitigation that raises the privilege bar but does not eliminate the flaw.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-55365 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy