What is the CVSS score of EUVD-2026-55375?

EUVD-2026-55375 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by EUVD-2026-55375?

A memory corruption vulnerability in the Linux kernel's Intel Xe GPU driver enables local privilege escalation on affected systems, allowing users with local access to gain kernel-level control.. A patch is available.

How to fix or mitigate EUVD-2026-55375?

Within 24 hours, inventory all Linux systems with Intel Xe or Arc discrete GPUs and determine current kernel versions to identify exposure. Within 7 days, begin kernel patching to version 6.18.44, 7.1.6, or 7.2-rc1 or later, starting with non-production systems to validate stability with GPU compute workloads. Within 30 days, complete patching across all production systems, prioritizing GPU compute clusters and shared workstations where multiple users have local access.

Linux Kernel EUVD-2026-55375

| CVE-2026-68274 HIGH

2026-08-10 Linux

GHSA-v84f-f8j3-97q7

Buffer Overflow Linux

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Hardware-specific precondition (compute-only DSS bits on Intel Xe GPU) raises AC to High; low-privilege local access is still required per description and confirmed by CVSS PR:L.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

7.0 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 14, 2026 - 03:21 vuln.today

CVSS changed

Aug 13, 2026 - 23:37 NVD

7.8 (HIGH)

Patch available

Aug 10, 2026 - 14:18 EUVD

CVE Published

Aug 10, 2026 - 12:01 cve.org

HIGH 7.8

CVE Published

Aug 10, 2026 - 12:01 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/guc: Fix buffer overflow in steered register list allocation

The size calculation for the steered register extarray uses only the geometry DSS mask (g_dss_mask) to determine the number of entries to allocate:

total = bitmap_weight(gt->fuse_topo.g_dss_mask, ...) * steer_reg_num;

However, the filling loop uses for_each_dss_steering(), which iterates over for_each_dss(), defined as the union of g_dss_mask and c_dss_mask (geometry + compute DSS). On platforms with compute-only DSS bits, the loop writes past the allocated buffer, corrupting adjacent slab objects.

This manifests as list_del corruption and SLUB redzone overwrites during drm_managed_release on device unbind, since the overflow corrupts the drmres list_head of neighboring allocations.

Fix by computing the allocation size using the union of both DSS masks, matching the iteration pattern of for_each_dss_steering().

-- v2:

use bitmap_weighted_or() (Zhanjun)

(cherry picked from commit 0a78a44f4901aa6c9263e66be7fce02282f1109f)

AnalysisAI

Heap buffer overflow in the Linux kernel's Intel Xe GPU DRM driver (drm/xe/guc) corrupts kernel slab memory during device unbind, creating a local privilege escalation path on systems hosting Intel Xe/Arc discrete GPUs with compute-only DSS hardware units. The root cause is a mismatch between the steered register extarray allocation size - derived solely from the geometry DSS mask - and the fill loop, which iterates over the union of geometry and compute DSS masks, writing past the allocated region on affected hardware configurations. Vendor-released patches are available in kernel versions 6.18.44, 7.1.6, and 7.2-rc1; no public exploit code or CISA KEV listing exists at time of analysis.

Technical ContextAI

The vulnerability resides in the xe kernel module - Intel's DRM driver for Xe/Arc discrete GPUs, introduced in Linux 6.13 - specifically within the GuC (Graphics Microcontroller Unit) steered register management subsystem. Intel Xe GPUs expose compute and geometry execution resources as DSS (Dual Sub-Slice) units, tracked by two bitmasks: g_dss_mask (geometry DSS) and c_dss_mask (compute DSS). The for_each_dss_steering() macro iterates over the logical union of both masks via for_each_dss(), but the extarray allocation for the steered register list invokes bitmap_weight() only against g_dss_mask, underallocating on platforms with compute-only DSS bits - DSS entries present exclusively in c_dss_mask and absent from g_dss_mask. The resulting heap overflow corrupts the Linux SLUB slab allocator's adjacent objects, manifesting as list_del corruption and SLUB redzone overwrites in the drmres list_head of neighboring allocations during drm_managed_release on device unbind. The fix (v2 of the patch) uses bitmap_weighted_or() to compute allocation size over the union of both masks, matching the iteration behavior. Although NVD has not assigned a CWE, this maps clearly to CWE-787 (Out-of-Bounds Write). Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

The primary fix is upgrading to a patched kernel: 6.18.44 (https://git.kernel.org/stable/c/632ecc90e1ca5d3b6822bb4d08f84a175b6c42c0), 7.1.6 (https://git.kernel.org/stable/c/a9a020f3c11eba6573b699f9cf9245a51b025ade), or 7.2-rc1 (https://git.kernel.org/stable/c/b485bfb45555163bfa5f565d6a3415fcb3035b02). Distributions shipping kernels from 6.13 onward with the xe driver should apply vendor-backported patches per their security advisory cadence. Where immediate kernel upgrade is not feasible, blacklisting the xe kernel module via a modprobe.d configuration file (blacklist xe) prevents the vulnerable code path from loading entirely, with the trade-off of disabling all Intel Xe/Arc GPU functionality on the system. Restricting unprivileged write access to the xe driver's sysfs unbind interface (/sys/bus/pci/drivers/xe/unbind) reduces attacker-controlled trigger opportunities for the device unbind path, though it does not prevent overflow during system shutdown sequences. No additional vendor-documented workarounds are confirmed.

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

EUVD-2026-55375 vulnerability details – vuln.today

Back

Linux Kernel EUVD-2026-55375

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Buffer Overflow

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code