CVE-2025-68802: Linux Kernel XE Driver DoS Vulnerability

CVE-2025-68802 Overview

A resource exhaustion vulnerability exists in the Linux kernel's DRM/Xe driver subsystem. The exec and vm_bind ioctl handlers allow userspace to specify an arbitrary num_syncs value without proper bounds checking. When a very large num_syncs value is provided, the kernel attempts to perform an excessively large memory allocation, triggering kernel warnings from the page allocator and potentially leading to a denial of service condition.

Critical Impact

Local attackers can trigger kernel memory allocation warnings and potentially cause system instability by providing malicious input to the DRM/Xe ioctl interface.

Affected Products

• Linux kernel with DRM/Xe driver (Intel Xe graphics)
• Systems running Intel Xe GPU hardware with vulnerable kernel versions

Discovery Timeline

• 2026-01-13 - CVE CVE-2025-68802 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2025-68802

Vulnerability Analysis

The vulnerability resides in the Intel Xe graphics driver's ioctl handling code, specifically within the xe_exec_ioctl and vm_bind functions. These ioctls accept a num_syncs parameter from userspace that controls memory allocation sizes for synchronization objects. The kernel trusts this userspace-provided value without implementing appropriate bounds validation.

When an attacker supplies an extremely large num_syncs value, the kmalloc_array_noprof function attempts to allocate a correspondingly massive memory block. This triggers the kernel's page allocator warning mechanism at mm/page_alloc.c:5124 within the __alloc_frozen_pages_noprof function, as the allocation request exceeds reasonable limits for a single allocation.

The call trace demonstrates the exploitation path: the attack flows from userspace through the VFS ioctl handler, into the DRM ioctl dispatcher, and finally to the Xe-specific xe_exec_ioctl function where the vulnerable allocation occurs.

Root Cause

The root cause is missing input validation on the num_syncs parameter in the DRM/Xe ioctl handlers. The kernel code directly uses the userspace-provided value to calculate allocation sizes via kmalloc_array_noprof without first checking whether the value falls within reasonable bounds. This violates the principle of never trusting user input in kernel code.

Attack Vector

Exploitation requires local access to the system with permissions to interact with the DRM device node (typically /dev/dri/*). An attacker can craft a malicious ioctl call to either the exec or vm_bind interface, specifying an extremely large num_syncs value. The attack does not require elevated privileges beyond basic access to the graphics device, which is commonly available to unprivileged users on desktop systems.

The exploitation mechanism involves the following sequence:

1. Open a file descriptor to the Intel Xe DRM device
2. Construct an ioctl request with a maliciously large num_syncs value
3. Issue the ioctl syscall to trigger the oversized allocation
4. The kernel attempts the allocation and emits warnings, potentially impacting system stability

Detection Methods for CVE-2025-68802

Indicators of Compromise

• Kernel log messages containing warnings from __alloc_frozen_pages_noprof at mm/page_alloc.c:5124
• Call traces showing allocation failures originating from xe_exec_ioctl or xe_vm_bind_ioctl
• Unusual ioctl activity targeting DRM Xe device nodes from unprivileged processes
• Memory allocation failures or pressure events correlated with graphics driver operations

Detection Strategies

• Monitor kernel logs (dmesg) for page allocator warnings with call traces pointing to drivers/gpu/drm/xe/xe_exec.c
• Implement auditd rules to track ioctl syscalls targeting /dev/dri/* device nodes
• Use eBPF probes to monitor allocation sizes requested through the DRM subsystem
• Alert on repeated kernel warnings from the memory management subsystem

Monitoring Recommendations

• Configure syslog forwarding to aggregate kernel warning messages from affected systems
• Set up alerting for allocation failure patterns in the DRM/Xe driver call paths
• Monitor system memory pressure metrics for anomalous spikes correlated with graphics operations
• Enable ftrace or perf monitoring on production systems to capture exploitation attempts

How to Mitigate CVE-2025-68802

Immediate Actions Required

• Update the Linux kernel to a patched version that includes the DRM_XE_MAX_SYNCS bounds check
• Review systems running Intel Xe graphics hardware for vulnerable kernel versions
• Consider restricting access to DRM device nodes for untrusted users as a temporary measure
• Monitor affected systems for exploitation attempts while planning updates

Patch Information

The fix introduces a new constant DRM_XE_MAX_SYNCS set to 1024, establishing a reasonable upper bound for the num_syncs parameter. Any ioctl request specifying a num_syncs value exceeding this limit is rejected at the top of the exec function before any allocation attempt occurs.

The kernel patches are available through the following Git commits:

• Kernel Git Commit 1d200017f55f
• Kernel Git Commit 8e4613040091
• Kernel Git Commit e281d1fd6903

The original fix was cherry-picked from commit b07bac9bd708ec468cd1b8a5fe70ae2ac9b0a11c.

Workarounds

• Restrict access to DRM device nodes by modifying udev rules or file permissions to limit exposure
• Use kernel security modules (SELinux, AppArmor) to create policies restricting ioctl access to DRM devices
• Deploy the patched kernel version as the primary remediation strategy
• Consider disabling the Xe driver via kernel module blacklisting if Intel Xe graphics support is not required

# Restrict DRM device access (temporary workaround)
# Add udev rule to limit DRM device permissions
echo 'SUBSYSTEM=="drm", MODE="0660", GROUP="video"' > /etc/udev/rules.d/99-drm-restrict.rules
udevadm control --reload-rules && udevadm trigger

# Verify kernel version includes the fix
uname -r
# Check kernel changelog for DRM_XE_MAX_SYNCS implementation