CVE-2026-68264: Linux Kernel Use-After-Free Vulnerability

CVE-2026-68264 Overview

CVE-2026-68264 is a Linux kernel vulnerability in the Intel Xe DRM driver's page table update path (drm/xe/pt). The function xe_pt_update_ops_init() fails to reset the current_op counter before running the prepare pass. When the xe_validation_guard() / drm_exec_until_all_locked() loop retries due to lock contention or out-of-memory eviction, bind_op_prepare() increments current_op on each retry without resetting it. After enough retries, current_op exceeds the array size allocated by xe_vma_ops_alloc(), producing an out-of-bounds write into SLUB-poisoned memory and a subsequent use-after-free in xe_migrate_update_pgtables_cpu().

Critical Impact
A local user with access to the Xe DRM device can trigger memory corruption and a use-after-free in kernel context, leading to denial of service or potential privilege escalation.

Affected Products

Linux kernel builds shipping the Intel Xe DRM driver (drm/xe)
Stable kernel branches referenced in the fix commits 157b1e3384, 6384271ac1, 90e4fd331b, and be5c39730a
Systems using Intel graphics hardware supported by the Xe driver on the vm_bind path

Discovery Timeline

2026-08-10 - CVE-2026-68264 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68264

Vulnerability Analysis

The defect resides in the Xe DRM driver's page table update preparation logic. On the vm_bind path, ops_execute() invokes xe_pt_update_ops_prepare() inside a retry loop guarded by xe_validation_guard() and drm_exec_until_all_locked(). This loop retries when it encounters lock contention (drm_exec_retry_on_contention()) or memory pressure (xe_validation_retry_on_oom()).

Each retry re-runs the prepare pass against the same vops structure. bind_op_prepare() increments the current_op index every call but never resets it at the start of a prepare cycle. After N retries, the index moves past the bounds of the operations array allocated by xe_vma_ops_alloc().

The out-of-bounds write lands in SLUB-poisoned memory. Later, xe_migrate_update_pgtables_cpu() reads a corrupted pt_op->bind field, producing a use-after-free crash. Two related fields, needs_svm_lock and needs_invalidation, are also derived during the same prepare pass. Failure to reset them causes incorrect migrate operation selection and redundant TLB invalidations on retry.

Root Cause

The root cause is missing state re-initialization in a retryable code path. xe_pt_update_ops_init() initialized state for a single pass, not for a loop that may run the prepare pass multiple times. The counter current_op accumulates across retries because the function that should reset it is only executed once. This is an input validation and state management flaw on the boundary of a retry primitive.

Attack Vector

Exploitation requires local access with permissions to open the DRM render node and issue vm_bind operations. An attacker induces the retry loop by creating lock contention on shared BOs or by driving the system toward memory pressure to trigger OOM eviction. Repeated retries push current_op past the array size, corrupting adjacent SLUB objects and setting up the follow-on use-after-free in xe_migrate_update_pgtables_cpu().

No synthetic exploitation code is included here. Refer to the upstream commits for the exact fix. See the Kernel Git Commit 046045543e53 for the reset logic applied in xe_pt_update_ops_init().

Detection Methods for CVE-2026-68264

Indicators of Compromise

Kernel oops or panic traces referencing xe_migrate_update_pgtables_cpu, xe_pt_update_ops_prepare, or bind_op_prepare.
KASAN or SLUB debug reports flagging out-of-bounds writes or use-after-free against Xe VMA operation arrays.
Repeated drm_exec_retry_on_contention or xe_validation_retry_on_oom events preceding a crash in dmesg.

Detection Strategies

Enable CONFIG_KASAN on test kernels to surface the out-of-bounds write during Xe vm_bind stress tests.
Monitor kernel log ingestion for stack traces containing Xe DRM page table update symbols and correlate with process identity.
Track running kernel versions against the fixed commit hashes to identify hosts still exposed.

Monitoring Recommendations

Forward /var/log/kern.log and journald kernel facility events to a centralized log platform and alert on Xe DRM crash signatures.
Baseline expected vm_bind activity per workload and flag processes issuing abnormal volumes of bind operations under memory pressure.
Inventory Intel graphics hosts and record kernel uname -r values to prioritize patch rollout.

How to Mitigate CVE-2026-68264

Immediate Actions Required

Apply the vendor kernel update containing the reset of current_op, needs_svm_lock, and needs_invalidation in xe_pt_update_ops_init().
Restrict access to DRM render nodes (/dev/dri/renderD*) to trusted local users on multi-tenant systems.
Reboot after patching to ensure the fixed kernel image is loaded.

Patch Information

The fix resets current_op, needs_svm_lock, and needs_invalidation at the start of xe_pt_update_ops_init() so each prepare pass begins from a clean state. It was cherry-picked from upstream commit 046045543e530605c441063535e7dca0075369a6 and backported through the following stable commits: 157b1e3384, 6384271ac1, 90e4fd331b, and be5c39730a.

Workarounds

Blacklist the xe module on hosts that do not require Intel Xe graphics acceleration until the patched kernel is installed.
Reduce memory pressure on affected systems to lower the probability of triggering the retry loop that exposes the flaw.
Constrain DRM device permissions using udev rules so that only vetted service accounts can issue vm_bind operations.

bash

# Configuration example: prevent unprivileged loading of the xe driver
echo 'blacklist xe' | sudo tee /etc/modprobe.d/blacklist-xe.conf
sudo update-initramfs -u