CVE-2025-68802 (GCVE-0-2025-68802)

Vulnerability from cvelistv5 – Published: 2026-01-13 15:29 – Updated: 2026-05-11 21:53
VLAI
Title
drm/xe: Limit num_syncs to prevent oversized allocations
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Limit num_syncs to prevent oversized allocations The exec and vm_bind ioctl allow userspace to specify an arbitrary num_syncs value. Without bounds checking, a very large num_syncs can force an excessively large allocation, leading to kernel warnings from the page allocator as below. Introduce DRM_XE_MAX_SYNCS (set to 1024) and reject any request exceeding this limit. " ------------[ cut here ]------------ WARNING: CPU: 0 PID: 1217 at mm/page_alloc.c:5124 __alloc_frozen_pages_noprof+0x2f8/0x2180 mm/page_alloc.c:5124 ... Call Trace: <TASK> alloc_pages_mpol+0xe4/0x330 mm/mempolicy.c:2416 ___kmalloc_large_node+0xd8/0x110 mm/slub.c:4317 __kmalloc_large_node_noprof+0x18/0xe0 mm/slub.c:4348 __do_kmalloc_node mm/slub.c:4364 [inline] __kmalloc_noprof+0x3d4/0x4b0 mm/slub.c:4388 kmalloc_noprof include/linux/slab.h:909 [inline] kmalloc_array_noprof include/linux/slab.h:948 [inline] xe_exec_ioctl+0xa47/0x1e70 drivers/gpu/drm/xe/xe_exec.c:158 drm_ioctl_kernel+0x1f1/0x3e0 drivers/gpu/drm/drm_ioctl.c:797 drm_ioctl+0x5e7/0xc50 drivers/gpu/drm/drm_ioctl.c:894 xe_drm_ioctl+0x10b/0x170 drivers/gpu/drm/xe/xe_device.c:224 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:598 [inline] __se_sys_ioctl fs/ioctl.c:584 [inline] __x64_sys_ioctl+0x18b/0x210 fs/ioctl.c:584 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xbb/0x380 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f ... " v2: Add "Reported-by" and Cc stable kernels. v3: Change XE_MAX_SYNCS from 64 to 1024. (Matt & Ashutosh) v4: s/XE_MAX_SYNCS/DRM_XE_MAX_SYNCS/ (Matt) v5: Do the check at the top of the exec func. (Matt) (cherry picked from commit b07bac9bd708ec468cd1b8a5fe70ae2ac9b0a11c)
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: dd08ebf6c3525a7ea2186e636df064ea47281987 , < e281d1fd6903a081ef023c341145ae92258e38d2 (git)
Affected: dd08ebf6c3525a7ea2186e636df064ea47281987 , < 1d200017f55f829b9e376093bd31dfbec92081de (git)
Affected: dd08ebf6c3525a7ea2186e636df064ea47281987 , < 8e461304009135270e9ccf2d7e2dfe29daec9b60 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.8
Unaffected: 0 , < 6.8 (semver)
Unaffected: 6.12.64 , ≤ 6.12.* (semver)
Unaffected: 6.18.3 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_exec.c",
            "drivers/gpu/drm/xe/xe_vm.c",
            "include/uapi/drm/xe_drm.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e281d1fd6903a081ef023c341145ae92258e38d2",
              "status": "affected",
              "version": "dd08ebf6c3525a7ea2186e636df064ea47281987",
              "versionType": "git"
            },
            {
              "lessThan": "1d200017f55f829b9e376093bd31dfbec92081de",
              "status": "affected",
              "version": "dd08ebf6c3525a7ea2186e636df064ea47281987",
              "versionType": "git"
            },
            {
              "lessThan": "8e461304009135270e9ccf2d7e2dfe29daec9b60",
              "status": "affected",
              "version": "dd08ebf6c3525a7ea2186e636df064ea47281987",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_exec.c",
            "drivers/gpu/drm/xe/xe_vm.c",
            "include/uapi/drm/xe_drm.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.64",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.3",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Limit num_syncs to prevent oversized allocations\n\nThe exec and vm_bind ioctl allow userspace to specify an arbitrary\nnum_syncs value. Without bounds checking, a very large num_syncs\ncan force an excessively large allocation, leading to kernel warnings\nfrom the page allocator as below.\n\nIntroduce DRM_XE_MAX_SYNCS (set to 1024) and reject any request\nexceeding this limit.\n\n\"\n------------[ cut here ]------------\nWARNING: CPU: 0 PID: 1217 at mm/page_alloc.c:5124 __alloc_frozen_pages_noprof+0x2f8/0x2180 mm/page_alloc.c:5124\n...\nCall Trace:\n \u003cTASK\u003e\n alloc_pages_mpol+0xe4/0x330 mm/mempolicy.c:2416\n ___kmalloc_large_node+0xd8/0x110 mm/slub.c:4317\n __kmalloc_large_node_noprof+0x18/0xe0 mm/slub.c:4348\n __do_kmalloc_node mm/slub.c:4364 [inline]\n __kmalloc_noprof+0x3d4/0x4b0 mm/slub.c:4388\n kmalloc_noprof include/linux/slab.h:909 [inline]\n kmalloc_array_noprof include/linux/slab.h:948 [inline]\n xe_exec_ioctl+0xa47/0x1e70 drivers/gpu/drm/xe/xe_exec.c:158\n drm_ioctl_kernel+0x1f1/0x3e0 drivers/gpu/drm/drm_ioctl.c:797\n drm_ioctl+0x5e7/0xc50 drivers/gpu/drm/drm_ioctl.c:894\n xe_drm_ioctl+0x10b/0x170 drivers/gpu/drm/xe/xe_device.c:224\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:598 [inline]\n __se_sys_ioctl fs/ioctl.c:584 [inline]\n __x64_sys_ioctl+0x18b/0x210 fs/ioctl.c:584\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xbb/0x380 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n...\n\"\n\nv2: Add \"Reported-by\" and Cc stable kernels.\nv3: Change XE_MAX_SYNCS from 64 to 1024. (Matt \u0026 Ashutosh)\nv4: s/XE_MAX_SYNCS/DRM_XE_MAX_SYNCS/ (Matt)\nv5: Do the check at the top of the exec func. (Matt)\n\n(cherry picked from commit b07bac9bd708ec468cd1b8a5fe70ae2ac9b0a11c)"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:53:37.315Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e281d1fd6903a081ef023c341145ae92258e38d2"
        },
        {
          "url": "https://git.kernel.org/stable/c/1d200017f55f829b9e376093bd31dfbec92081de"
        },
        {
          "url": "https://git.kernel.org/stable/c/8e461304009135270e9ccf2d7e2dfe29daec9b60"
        }
      ],
      "title": "drm/xe: Limit num_syncs to prevent oversized allocations",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68802",
    "datePublished": "2026-01-13T15:29:11.079Z",
    "dateReserved": "2025-12-24T10:30:51.045Z",
    "dateUpdated": "2026-05-11T21:53:37.315Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-68802",
      "date": "2026-08-17",
      "epss": "0.00172",
      "percentile": "0.06978"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-68802\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-01-13T16:16:02.260\",\"lastModified\":\"2026-06-17T09:59:36.843\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/xe: Limit num_syncs to prevent oversized allocations\\n\\nThe exec and vm_bind ioctl allow userspace to specify an arbitrary\\nnum_syncs value. Without bounds checking, a very large num_syncs\\ncan force an excessively large allocation, leading to kernel warnings\\nfrom the page allocator as below.\\n\\nIntroduce DRM_XE_MAX_SYNCS (set to 1024) and reject any request\\nexceeding this limit.\\n\\n\\\"\\n------------[ cut here ]------------\\nWARNING: CPU: 0 PID: 1217 at mm/page_alloc.c:5124 __alloc_frozen_pages_noprof+0x2f8/0x2180 mm/page_alloc.c:5124\\n...\\nCall Trace:\\n \u003cTASK\u003e\\n alloc_pages_mpol+0xe4/0x330 mm/mempolicy.c:2416\\n ___kmalloc_large_node+0xd8/0x110 mm/slub.c:4317\\n __kmalloc_large_node_noprof+0x18/0xe0 mm/slub.c:4348\\n __do_kmalloc_node mm/slub.c:4364 [inline]\\n __kmalloc_noprof+0x3d4/0x4b0 mm/slub.c:4388\\n kmalloc_noprof include/linux/slab.h:909 [inline]\\n kmalloc_array_noprof include/linux/slab.h:948 [inline]\\n xe_exec_ioctl+0xa47/0x1e70 drivers/gpu/drm/xe/xe_exec.c:158\\n drm_ioctl_kernel+0x1f1/0x3e0 drivers/gpu/drm/drm_ioctl.c:797\\n drm_ioctl+0x5e7/0xc50 drivers/gpu/drm/drm_ioctl.c:894\\n xe_drm_ioctl+0x10b/0x170 drivers/gpu/drm/xe/xe_device.c:224\\n vfs_ioctl fs/ioctl.c:51 [inline]\\n __do_sys_ioctl fs/ioctl.c:598 [inline]\\n __se_sys_ioctl fs/ioctl.c:584 [inline]\\n __x64_sys_ioctl+0x18b/0x210 fs/ioctl.c:584\\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\\n do_syscall_64+0xbb/0x380 arch/x86/entry/syscall_64.c:94\\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n...\\n\\\"\\n\\nv2: Add \\\"Reported-by\\\" and Cc stable kernels.\\nv3: Change XE_MAX_SYNCS from 64 to 1024. (Matt \u0026 Ashutosh)\\nv4: s/XE_MAX_SYNCS/DRM_XE_MAX_SYNCS/ (Matt)\\nv5: Do the check at the top of the exec func. (Matt)\\n\\n(cherry picked from commit b07bac9bd708ec468cd1b8a5fe70ae2ac9b0a11c)\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\ndrm/xe: Limitar num_syncs para prevenir asignaciones de tama\u00f1o excesivo\\n\\nLas ioctl exec y vm_bind permiten al espacio de usuario especificar un valor num_syncs arbitrario. Sin comprobaci\u00f3n de l\u00edmites, un num_syncs muy grande puede forzar una asignaci\u00f3n excesivamente grande, lo que lleva a advertencias del kernel del asignador de p\u00e1ginas como se muestra a continuaci\u00f3n.\\n\\nIntroducir DRM_XE_MAX_SYNCS (establecido en 1024) y rechazar cualquier solicitud que exceda este l\u00edmite.\\n\\n\u0027------------[ cut here ]------------\\nWARNING: CPU: 0 PID: 1217 at mm/page_alloc.c:5124 __alloc_frozen_pages_noprof+0x2f8/0x2180 mm/page_alloc.c:5124\\n...\\nCall Trace:\\n \\n alloc_pages_mpol+0xe4/0x330 mm/mempolicy.c:2416\\n ___kmalloc_large_node+0xd8/0x110 mm/slub.c:4317\\n __kmalloc_large_node_noprof+0x18/0xe0 mm/slub.c:4348\\n __do_kmalloc_node mm/slub.c:4364 [inline]\\n __kmalloc_noprof+0x3d4/0x4b0 mm/slub.c:4388\\n kmalloc_noprof include/linux/slab.h:909 [inline]\\n kmalloc_array_noprof include/linux/slab.h:948 [inline]\\n xe_exec_ioctl+0xa47/0x1e70 drivers/gpu/drm/xe/xe_exec.c:158\\n drm_ioctl_kernel+0x1f1/0x3e0 drivers/gpu/drm/drm_ioctl.c:797\\n drm_ioctl+0x5e7/0xc50 drivers/gpu/drm/drm_ioctl.c:894\\n xe_drm_ioctl+0x10b/0x170 drivers/gpu/drm/xe/xe_device.c:224\\n vfs_ioctl fs/ioctl.c:51 [inline]\\n __do_sys_ioctl fs/ioctl.c:598 [inline]\\n __se_sys_ioctl fs/ioctl.c:584 [inline]\\n __x64_sys_ioctl+0x18b/0x210 fs/ioctl.c:584\\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\\n do_syscall_64+0xbb/0x380 arch/x86/entry/syscall_64.c:94\\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n...\u0027\\n\\nv2: A\u00f1adir \u0027Reported-by\u0027 y Cc kernels estables.\\nv3: Cambiar XE_MAX_SYNCS de 64 a 1024. (Matt y Ashutosh)\\nv4: s/XE_MAX_SYNCS/DRM_XE_MAX_SYNCS/ (Matt)\\nv5: Realizar la comprobaci\u00f3n al principio de la funci\u00f3n exec. (Matt)\\n\\n(cherry picked from commit b07bac9bd708ec468cd1b8a5fe70ae2ac9b0a11c)\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/xe/xe_exec.c\",\"drivers/gpu/drm/xe/xe_vm.c\",\"include/uapi/drm/xe_drm.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"dd08ebf6c3525a7ea2186e636df064ea47281987\",\"lessThan\":\"e281d1fd6903a081ef023c341145ae92258e38d2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"dd08ebf6c3525a7ea2186e636df064ea47281987\",\"lessThan\":\"1d200017f55f829b9e376093bd31dfbec92081de\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"dd08ebf6c3525a7ea2186e636df064ea47281987\",\"lessThan\":\"8e461304009135270e9ccf2d7e2dfe29daec9b60\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/xe/xe_exec.c\",\"drivers/gpu/drm/xe/xe_vm.c\",\"include/uapi/drm/xe_drm.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.64\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.3\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1d200017f55f829b9e376093bd31dfbec92081de\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8e461304009135270e9ccf2d7e2dfe29daec9b60\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e281d1fd6903a081ef023c341145ae92258e38d2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-06-28T07:11:22+00:00",
      "cve": "CVE-2025-68802",
      "id": "CVE-2025-68802",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/xe: Limit num_syncs to prevent oversized allocations",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68802.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "low",
      "current_release_date": "2026-07-15T05:46:33Z",
      "cve": "CVE-2025-68802",
      "id": "CVE-2025-68802",
      "initial_release_date": "2026-01-15T00:26:00Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "260",
      "product_status:recommended": "256",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-68802",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-68802.json",
      "version": "23"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.