CVE-2026-68384 Overview
CVE-2026-68384 is a race condition in the Linux kernel's drm/xe graphics driver affecting Virtual Function (VF) Compression Control Surface (CCS) handling. The flaw exists in xe_bo_move(), which attaches and detaches VF CCS read/write batch buffers to a Buffer Object (BO) without waiting for in-flight copy/clear fences to signal. A VF migration event that pauses execution mid-copy can observe partially copied CCS metadata or race the save/restore path against a still-running blit. The vulnerability requires local access with low privileges and impacts confidentiality, integrity, and availability of the affected system.
Critical Impact
Local attackers with low privileges can trigger memory corruption or state inconsistency in kernel graphics memory management, potentially leading to privilege escalation or denial of service on systems using Intel Xe graphics with SR-IOV virtualization.
Affected Products
- Linux kernel with drm/xe driver supporting VF CCS operations
- Systems using Intel Xe graphics with SR-IOV Virtual Function configurations
- Kernel versions prior to the commits referenced in the stable tree
Discovery Timeline
- 2026-08-10 - CVE-2026-68384 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-68384
Vulnerability Analysis
The vulnerability resides in xe_bo_move() within the drm/xe driver, which manages buffer object migrations between memory domains. When a BO transitions from NULL/SYSTEM to TT, the driver attaches VF CCS read/write batch buffers (BBs). When the BO transitions from TT back to SYSTEM, those batch buffers are detached. Both operations previously executed synchronously on the CPU immediately after building the move's copy/clear fence, without waiting for that fence to signal.
This synchronous handling creates two distinct race windows. First, the attach step happens too late relative to the copy job it protects. If a copy job is submitted before the CCS batch buffers are attached, a VF migration event pausing execution mid-copy can observe partially copied CCS metadata without the attach state required to correctly save and restore it. Second, the detach step happens too early. The CCS batch buffers are torn down right after the copy fence is obtained, while the underlying blit may still be in flight.
Root Cause
The root cause is a Time-of-Check Time-of-Use (TOCTOU) race between fence lifecycle and CCS metadata attachment. xe_migrate_ccs_rw_copy() previously did not receive the destination resource explicitly, and xe_sriov_vf_ccs_attach_bo() failed to unwind properly. The per-context loop never broke on error, silently discarding earlier failures during attach.
Attack Vector
An attacker with local access and low privileges can trigger buffer object migrations under conditions that induce VF migration events during in-flight copy operations. Exploiting the timing window between fence signaling and CCS batch buffer attach/detach allows the attacker to corrupt kernel state tracking of compression metadata. This can produce inconsistent memory contents that the save/restore path mishandles.
No verified public exploit code is available. Technical details are documented in the Linux Kernel Commit Log.
Detection Methods for CVE-2026-68384
Indicators of Compromise
- Unexpected kernel warnings or oops entries referencing xe_bo_move, xe_migrate_ccs_rw_copy, or xe_sriov_vf_ccs_attach_bo in dmesg
- Graphics driver instability or GPU hangs correlated with VF migration events in virtualized environments
- Inconsistent buffer object state after SR-IOV VF pause/resume cycles
Detection Strategies
- Audit installed kernel versions against the fixed commits 35ba43b5, 56441f9e, and f2ebfd5c in the stable tree
- Monitor dmesg and journal output for drm/xe subsystem errors during VF operations
- Correlate GPU state anomalies with virtualization migration events to identify race triggering
Monitoring Recommendations
- Enable kernel lockdep and KASAN in test environments to surface race-condition symptoms early
- Collect /var/log/kern.log and hypervisor VF migration logs into a central SIEM for correlation
- Track kernel package versions across virtualization hosts to identify unpatched systems running Intel Xe with SR-IOV
How to Mitigate CVE-2026-68384
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the stable tree commits 35ba43b5, 56441f9e, and f2ebfd5c
- Inventory hosts running Intel Xe graphics drivers with SR-IOV Virtual Function configurations
- Restrict local access to systems using VF CCS functionality until patches are applied
Patch Information
The fix moves the attach call to before the copy/clear job is submitted, ensuring CCS batch buffers are registered when the copy runs. On attach failure, the code unwinds and bails out of the move. xe_migrate_ccs_rw_copy() now takes the destination resource explicitly. The detach step now waits for the copy fence to signal before tearing down the CCS batch buffers. xe_sriov_vf_ccs_attach_bo() was also corrected to properly unwind by clearing each attached context directly via xe_migrate_ccs_rw_copy_clear(). Patch details are available in the Linux Kernel Commit Log.
Workarounds
- Disable SR-IOV Virtual Function usage on affected Intel Xe graphics hardware where operationally feasible
- Limit workloads that trigger frequent BO migrations across memory domains until patched kernels are deployed
- Enforce least-privilege access controls to prevent untrusted local users from invoking DRM ioctls
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
