CVE-2026-68264

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the Linux kernel where the function xe pt update ops init() fails to reset the current op variable to 0. During the vm bind path, the ops execute() function calls xe pt update ops prepare() within a loop. If the loop retries due to Out-of-Memory (OOM) eviction or lock contention, xe pt update ops prepare() executes again, and each call to bind op prepare() increments current op without resetting it. Consequently, current op can exceed the array size allocated by xe vma ops alloc(), leading to an out-of-bounds write into SLUB-poisoned memory. This results in a Use-After-Free (UAF) crash in xe migrate update pgtables cpu() when reading the corrupted pt op->bind. Additionally, the failure to reset needs svm lock and needs invalidation can lead to incorrect migrate operations selection and redundant Translation Lookaside Buffer (TLB) invalidation. TLB is a hardware cache used by the memory management unit to improve virtual-to-physical address translation speed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.