{"id":"CVE-2026-68305","revision":null,"records":[{"revision":"700c1b045cc645d79013983ea7bac648","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-68305","aliases":[],"title":"drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers\n\nCCS read/write buffers are freed during BO destruction. In some cases,\nBOs may be destroyed after the device is unbound but while the DRM\nstructure remains valid, leading to NULL pointer dereferences when\naccessing device resources.\n\nBUG: kernel NULL pointer dereference, address: 0000000000000000\nPGD 0 P4D 0\nOops: Oops: 0000 [#1] SMP NOPTI\nCPU: 0 UID: 0 PID: 9376 Comm: xe_pat Not tainted 7.2.0-rc2+ #1 PREEMPT(lazy)\nRIP: 0010:xe_sriov_vf_ccs_rw_update_bb_addr+0x4d/0xa0 [xe]\nRSP: 0018:ffffcf304110b9c8 EFLAGS: 00010246\nRAX: ffff8a85c38a0a00 RBX: 00000000810ef000 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8a85c39c1888\nRBP: ffffcf304110b9e8 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: ffff8a85c39c1888\nR13: 0000000000000000 R14: ffff8a85c39b4f28 R15: ffff8a85c3885000\nFS:  0000000000000000(0000) GS:ffff8a878b809000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000000 CR3: 000000010314a002 CR4: 0000000000772ef0\nPKRU: 55555554\nCall Trace:\n <TASK>\n xe_migrate_ccs_rw_copy_clear+0x98/0x120 [xe]\n xe_sriov_vf_ccs_detach_bo+0x2c/0x60 [xe]\n xe_ttm_bo_delete_mem_notify+0xc8/0xe0 [xe]\n ttm_bo_cleanup_memtype_use+0x26/0x80 [ttm]\n ttm_bo_release+0x29e/0x2d0 [ttm]\n ttm_bo_fini+0x39/0x70 [ttm]\n xe_gem_object_free+0x1f/0x30 [xe]\n drm_gem_object_free+0x1d/0x40\n ttm_bo_vm_close+0x5f/0x90 [ttm]\n remove_vma+0x2c/0x70\n tear_down_vmas+0x63/0xf0\n exit_mmap+0x20d/0x3f0\n __mmput+0x45/0x170\n mmput+0x31/0x40\n do_exit+0x2ba/0xac0\n do_group_exit+0x2d/0xb0\n __x64_sys_exit_group+0x18/0x20\n x64_sys_call+0x14a0/0x2390\n do_syscall_64+0xdd/0x640\n ? count_memcg_events+0xea/0x240\n ? handle_mm_fault+0x1ec/0x2f0\n\n(cherry picked from commit 1ae415a6eefe5004954a1d352b1718faca8844ef)","state":0,"publishedAt":"2026-08-10T12:02:39.911+00:00","modifiedAt":"2026-10-19T21:09:04.378+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/gpu/drm/xe/xe_migrate.c\",\n                        \"drivers/gpu/drm/xe/xe_migrate.h\",\n                        \"drivers/gpu/drm/xe/xe_sriov_vf_ccs.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"864690cf4dd62482b6dd049d82c509886c904303\",\n                            \"lessThan\": \"0c07e046e639160a1597830c4c5615ee2a4a5ed5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"864690cf4dd62482b6dd049d82c509886c904303\",\n                            \"lessThan\": \"523ed2831ee55b2a1edabdea96781651f9df9685\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"864690cf4dd62482b6dd049d82c509886c904303\",\n                            \"lessThan\": \"4c92afb4c143526d340545ca581e88e6952ea511\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/gpu/drm/xe/xe_migrate.c\",\n                        \"drivers/gpu/drm/xe/xe_migrate.h\",\n                        \"drivers/gpu/drm/xe/xe_sriov_vf_ccs.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.18\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.18\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.57\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.6\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/0c07e046e639160a1597830c4c5615ee2a4a5ed5","https://git.kernel.org/stable/c/523ed2831ee55b2a1edabdea96781651f9df9685","https://git.kernel.org/stable/c/4c92afb4c143526d340545ca581e88e6952ea511"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-68305","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-68305","identifiers":["CVE-2026-68305"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-08T15:12:21.7721538+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-08T15:12:21.7721538+00:00","lastSuccessAt":"2026-11-08T15:12:23.3131168+00:00","error":null,"lastVerifiedAt":"2026-11-08T15:12:23.3132386+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-eaa64dac63caa79c8d4905619258c41c51b39e461b996124e1a21b5e85e7e738-a99d659450dc34354959c6122d848d4ccd07f29ea21abcc1586cf3d160224c73","complete":true,"records":421173,"lastAttemptAt":"2026-11-08T15:11:37.1519474+00:00","lastSuccessAt":"2026-11-08T15:04:21.1700721+00:00","error":null,"lastVerifiedAt":"2026-11-08T15:11:37.1519474+00:00","snapshotPublishedAt":"2026-11-08T14:26:36+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-383c643166b94ac4b6a615647191978e","complete":true,"records":13654,"lastAttemptAt":"2026-11-08T15:12:52.0979565+00:00","lastSuccessAt":"2026-11-08T13:04:50.073+00:00","error":null,"lastVerifiedAt":"2026-11-08T13:04:50.073+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13706,"expectedIdentifiers":13706,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-08T15:12:21.7721538+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-08T15:12:21.7721538+00:00","lastSuccessAt":"2026-11-08T15:12:25.6162622+00:00","error":null,"lastVerifiedAt":"2026-11-08T15:12:25.6162636+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-88d28889864e42cea6aa55e892fd5cd0","complete":false,"records":13666,"lastAttemptAt":"2026-11-08T15:12:51.2847048+00:00","lastSuccessAt":"2026-11-08T15:12:51.28+00:00","error":null,"lastVerifiedAt":"2026-11-08T15:12:51.28+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13706,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-980593e6977a6d1b4fb1eed5a1ffe88a468736f89f0a06f710924ad59132c023","complete":true,"records":9914,"lastAttemptAt":"2026-11-08T15:12:21.6170274+00:00","lastSuccessAt":"2026-11-08T11:07:07.068788+00:00","error":null,"lastVerifiedAt":"2026-11-08T15:12:21.6170274+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-08T15:12:14.3193577+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":"HttpRequestException","lastVerifiedAt":"2026-11-08T15:04:21.421573+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-964c14035e6f0f6478b2870fad6a7ef9f6045876d4a12af2c2e514521e54b6af","complete":true,"records":3055,"lastAttemptAt":"2026-11-08T15:12:21.6447495+00:00","lastSuccessAt":"2026-11-08T11:07:12.1927025+00:00","error":null,"lastVerifiedAt":"2026-11-08T15:12:21.6447495+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-f8647d7ba64b1ba0dfdc7130944766d5b36d5b77d18fff0c79e651a4cff3c2b9","complete":true,"records":231293,"lastAttemptAt":"2026-11-08T15:12:19.9920749+00:00","lastSuccessAt":"2026-11-08T11:06:56.2918717+00:00","error":null,"lastVerifiedAt":"2026-11-08T15:12:19.9920749+00:00","snapshotPublishedAt":"2026-11-08T11:02:50+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}