{"id":5420,"date":"2026-09-04T18:47:49","date_gmt":"2026-09-04T10:47:49","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-68305"},"modified":"2026-09-04T18:47:49","modified_gmt":"2026-09-04T10:47:49","slug":"cve-2026-68305","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-68305","title":{"rendered":"CVE-2026-68305 [HIGH] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\ndrm\/xe\/vf: Add drm_de"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>drm\/xe\/vf: Add drm_dev guards when detaching CCS read\/write buffers<\/p>\n<p>CCS read\/write buffers are freed during BO destruction. In some cases,<br \/>\nBOs may be destroyed after the device is unbound but while the DRM<br \/>\nstructure remains valid, leading to NULL pointer dereferences when<br \/>\naccessing device resources.<\/p>\n<p>BUG: kernel NULL pointer dereference, address: 0000000000000000<br \/>\nPGD 0 P4D 0<br \/>\nOops: Oops: 0000 [#1] SMP NOPTI<br \/>\nCPU: 0 UID: 0 PID: 9376 Comm: xe_pat Not tainted 7.2.0-rc2+ #1 PREEMPT(lazy)<br \/>\nRIP: 0010:xe_sriov_vf_ccs_rw_update_bb_addr+0x4d\/0xa0 [xe]<br \/>\nRSP: 0018:ffffcf304110b9c8 EFLAGS: 00010246<br \/>\nRAX: ffff8a85c38a0a00 RBX: 00000000810ef000 RCX: 0000000000000000<br \/>\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8a85c39c1888<br \/>\nRBP: ffffcf304110b9e8 R08: 0000000000000000 R09: 0000000000000000<br \/>\nR10: 0000000000000000 R11: 0000000000000000 R12: ffff8a85c39c1888<br \/>\nR13: 0000000000000000 R14: ffff8a85c39b4f28 R15: ffff8a85c3885000<br \/>\nFS:  0000000000000000(0000) GS:ffff8a878b809000(0000) knlGS:0000000000000000<br \/>\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033<br \/>\nCR2: 0000000000000000 CR3: 000000010314a002 CR4: 0000000000772ef0<br \/>\nPKRU: 55555554<br \/>\nCall Trace:<\/p>\n<p> xe_migrate_ccs_rw_copy_clear+0x98\/0x120 [xe]<br \/>\n xe_sriov_vf_ccs_detach_bo+0x2c\/0x60 [xe]<br \/>\n xe_ttm_bo_delete_mem_notify+0xc8\/0xe0 [xe]<br \/>\n ttm_bo_cleanup_memtype_use+0x26\/0x80 [ttm]<br \/>\n ttm_bo_release+0x29e\/0x2d0 [ttm]<br \/>\n ttm_bo_fini+0x39\/0x70 [ttm]<br \/>\n xe_gem_object_free+0x1f\/0x30 [xe]<br \/>\n drm_gem_object_free+0x1d\/0x40<br \/>\n ttm_bo_vm_close+0x5f\/0x90 [ttm]<br \/>\n remove_vma+0x2c\/0x70<br \/>\n tear_down_vmas+0x63\/0xf0<br \/>\n exit_mmap+0x20d\/0x3f0<br \/>\n __mmput+0x45\/0x170<br \/>\n mmput+0x31\/0x40<br \/>\n do_exit+0x2ba\/0xac0<br \/>\n do_group_exit+0x2d\/0xb0<br \/>\n __x64_sys_exit_group+0x18\/0x20<br \/>\n x64_sys_call+0x14a0\/0x2390<br \/>\n do_syscall_64+0xdd\/0x640<br \/>\n ? count_memcg_events+0xea\/0x240<br \/>\n ? handle_mm_fault+0x1ec\/0x2f0<\/p>\n<p>(cherry picked from commit 1ae415a6eefe5004954a1d352b1718faca8844ef)<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>drm\/xe\/vf: Add drm_dev guards when detaching CCS read\/write buffers<\/p>\n<p>CCS read\/write buffers are freed during BO destruction. In som<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-5420","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/5420","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5420"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5420"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5420"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}