Bug 2513452 (CVE-2026-68264)

Summary:	CVE-2026-68264 kernel: drm/xe/pt: Reset current_op in xe_pt_update_ops_init()
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel's drm/xe/pt module. During certain memory management operations, an internal counter is not properly reset. Repeated attempts to perform these operations, possibly due to resource contention or out-of-memory conditions, can cause this counter to exceed its allocated bounds. This leads to an out-of-bounds write and a subsequent use-after-free vulnerability, which can result in a system crash, causing a denial of service.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-10 12:38:09 UTC

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/pt: Reset current_op in xe_pt_update_ops_init()

xe_pt_update_ops_init() fails to reset current_op to 0. On the
vm_bind path, ops_execute() calls xe_pt_update_ops_prepare() inside
the xe_validation_guard() / drm_exec_until_all_locked() loop. When
that loop retries due to lock contention or OOM eviction
(drm_exec_retry_on_contention() / xe_validation_retry_on_oom()),
xe_pt_update_ops_prepare() runs again on the same vops, and each
call to bind_op_prepare() increments current_op without resetting it.

After N retries current_op exceeds the array size allocated by
xe_vma_ops_alloc(), causing an out-of-bounds write into
SLUB-poisoned memory and a subsequent UAF crash in
xe_migrate_update_pgtables_cpu() when reading the corrupted pt_op->bind.

Also reset needs_svm_lock and needs_invalidation which are derived in
the same prepare pass and would otherwise cause wrong migrate ops
selection and redundant TLB invalidation on retry.

Fix this by resetting current_op, needs_svm_lock and needs_invalidation
in xe_pt_update_ops_init().

v2 (Matt):
   - Add details in commit message.
   - Add Fixes tag and Cc to stable.org

(cherry picked from commit 046045543e530605c441063535e7dca0075369a6)

Comment 1 Mauro Matteo Cascella 2026-08-11 11:36:45 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026081023-CVE-2026-68264-6281@gregkh/T