GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-43280 (GCVE-0-2026-43280)

Vulnerability from cvelistv5 – Published: 2026-05-06 11:29 – Updated: 2026-08-05 12:27
VLAI
Title
drm/xe: Add bounds check on pat_index to prevent OOB kernel read in madvise
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Add bounds check on pat_index to prevent OOB kernel read in madvise When user provides a bogus pat_index value through the madvise IOCTL, the xe_pat_index_get_coh_mode() function performs an array access without validating bounds. This allows a malicious user to trigger an out-of-bounds kernel read from the xe->pat.table array. The vulnerability exists because the validation in madvise_args_are_sane() directly calls xe_pat_index_get_coh_mode(xe, args->pat_index.val) without first checking if pat_index is within [0, xe->pat.n_entries). Although xe_pat_index_get_coh_mode() has a WARN_ON to catch this in debug builds, it still performs the unsafe array access in production kernels. v2(Matthew Auld) - Using array_index_nospec() to mitigate spectre attacks when the value is used v3(Matthew Auld) - Put the declarations at the start of the block (cherry picked from commit 944a3329b05510d55c69c2ef455136e2fc02de29)
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ada7486c5668db542a7d361268df931aca5b726a , < ffba51100ff61792fefbae11ca38ac1987a818dd (git)
Affected: ada7486c5668db542a7d361268df931aca5b726a , < 79f52655567a6471ff3d0d6325ede91bb14461f4 (git)
Affected: ada7486c5668db542a7d361268df931aca5b726a , < fbbe32618e97eff81577a01eb7d9adcd64a216d7 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.18
Unaffected: 0 , < 6.18 (semver)
Unaffected: 6.18.16 , ≤ 6.18.* (semver)
Unaffected: 6.19.6 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_vm_madvise.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ffba51100ff61792fefbae11ca38ac1987a818dd",
              "status": "affected",
              "version": "ada7486c5668db542a7d361268df931aca5b726a",
              "versionType": "git"
            },
            {
              "lessThan": "79f52655567a6471ff3d0d6325ede91bb14461f4",
              "status": "affected",
              "version": "ada7486c5668db542a7d361268df931aca5b726a",
              "versionType": "git"
            },
            {
              "lessThan": "fbbe32618e97eff81577a01eb7d9adcd64a216d7",
              "status": "affected",
              "version": "ada7486c5668db542a7d361268df931aca5b726a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_vm_madvise.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Add bounds check on pat_index to prevent OOB kernel read in madvise\n\nWhen user provides a bogus pat_index value through the madvise IOCTL, the\nxe_pat_index_get_coh_mode() function performs an array access without\nvalidating bounds. This allows a malicious user to trigger an out-of-bounds\nkernel read from the xe-\u003epat.table array.\n\nThe vulnerability exists because the validation in madvise_args_are_sane()\ndirectly calls xe_pat_index_get_coh_mode(xe, args-\u003epat_index.val) without\nfirst checking if pat_index is within [0, xe-\u003epat.n_entries).\n\nAlthough xe_pat_index_get_coh_mode() has a WARN_ON to catch this in debug\nbuilds, it still performs the unsafe array access in production kernels.\n\nv2(Matthew Auld)\n- Using array_index_nospec() to mitigate spectre attacks when the value\nis used\n\nv3(Matthew Auld)\n- Put the declarations at the start of the block\n\n(cherry picked from commit 944a3329b05510d55c69c2ef455136e2fc02de29)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is a local DRM xe ioctl, reached by opening an xe DRM render device and issuing DRM_IOCTL_XE_VM_CREATE followed by DRM_IOCTL_XE_MADVISE. It is not reachable from network, adjacent, or physical input.\nAC:L - Exploitation requires only attacker-controlled ioctl arguments with type DRM_XE_MEM_RANGE_ATTR_PAT and an out-of-range pat_index; no race or hard-to-control state is required. A valid VM id can be created by the same unprivileged caller.\nPR:L - The ioctl is registered with DRM_RENDER_ALLOW and no DRM_AUTH, DRM_MASTER, or DRM_ROOT_ONLY gate, so a normal local user with access to the render node can reach it. It does not require real root or capabilities.\nUI:N - No victim action is needed after the attacker has local execution and device-node access. The attacker directly opens the DRM node and submits the ioctl.\nS:U - The bug is in the host kernel DRM driver and impacts kernel resources under the same security authority. It is not a VM escape, IOMMU bypass, or other cross-scope boundary violation.\nC:H - The flaw is an attacker-controlled out-of-bounds kernel read from xe-\u003epat.table via xe_pat_index_get_coh_mode(), with a u16 index range and no bounds check before the fix. Following the higher-severity rule for OOB kernel reads, this is scored as high confidentiality impact.\nI:N - The immediate primitive is an out-of-bounds read and validation oracle; the investigated path does not provide a direct kernel write or memory corruption primitive. A bad PAT value may be stored only if the OOB read happens to pass validation, but that does not establish arbitrary modification of protected data.\nA:H - Out-of-range pat_index values trigger WARN_ON in xe_pat_index_get_coh_mode(), and in hardened or panic_on_warn deployments this can panic the kernel. The same local user can repeatedly trigger the condition, so high availability impact is the higher defensible choice."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:27:02.301Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ffba51100ff61792fefbae11ca38ac1987a818dd"
        },
        {
          "url": "https://git.kernel.org/stable/c/79f52655567a6471ff3d0d6325ede91bb14461f4"
        },
        {
          "url": "https://git.kernel.org/stable/c/fbbe32618e97eff81577a01eb7d9adcd64a216d7"
        }
      ],
      "title": "drm/xe: Add bounds check on pat_index to prevent OOB kernel read in madvise",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43280",
    "datePublished": "2026-05-06T11:29:01.562Z",
    "dateReserved": "2026-05-01T14:12:55.998Z",
    "dateUpdated": "2026-08-05T12:27:02.301Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-43280",
      "date": "2026-09-15",
      "epss": "0.00118",
      "percentile": "0.01918"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-43280\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-06T12:16:49.477\",\"lastModified\":\"2026-06-17T10:49:18.073\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/xe: Add bounds check on pat_index to prevent OOB kernel read in madvise\\n\\nWhen user provides a bogus pat_index value through the madvise IOCTL, the\\nxe_pat_index_get_coh_mode() function performs an array access without\\nvalidating bounds. This allows a malicious user to trigger an out-of-bounds\\nkernel read from the xe-\u003epat.table array.\\n\\nThe vulnerability exists because the validation in madvise_args_are_sane()\\ndirectly calls xe_pat_index_get_coh_mode(xe, args-\u003epat_index.val) without\\nfirst checking if pat_index is within [0, xe-\u003epat.n_entries).\\n\\nAlthough xe_pat_index_get_coh_mode() has a WARN_ON to catch this in debug\\nbuilds, it still performs the unsafe array access in production kernels.\\n\\nv2(Matthew Auld)\\n- Using array_index_nospec() to mitigate spectre attacks when the value\\nis used\\n\\nv3(Matthew Auld)\\n- Put the declarations at the start of the block\\n\\n(cherry picked from commit 944a3329b05510d55c69c2ef455136e2fc02de29)\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/xe/xe_vm_madvise.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"ada7486c5668db542a7d361268df931aca5b726a\",\"lessThan\":\"ffba51100ff61792fefbae11ca38ac1987a818dd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ada7486c5668db542a7d361268df931aca5b726a\",\"lessThan\":\"79f52655567a6471ff3d0d6325ede91bb14461f4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ada7486c5668db542a7d361268df931aca5b726a\",\"lessThan\":\"fbbe32618e97eff81577a01eb7d9adcd64a216d7\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/xe/xe_vm_madvise.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.16\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.6\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.18\",\"versionEndExcluding\":\"6.18.16\",\"matchCriteriaId\":\"E0D300DB-AA68-4962-981D-EF9F5E97AACF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.6\",\"matchCriteriaId\":\"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/79f52655567a6471ff3d0d6325ede91bb14461f4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fbbe32618e97eff81577a01eb7d9adcd64a216d7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ffba51100ff61792fefbae11ca38ac1987a818dd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T14:55:26+00:00",
      "cve": "CVE-2026-43280",
      "id": "CVE-2026-43280",
      "initial_release_date": "2026-05-06T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/xe: Add bounds check on pat_index to prevent OOB kernel read in madvise",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43280.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-06T01:20:36Z",
      "cve": "CVE-2026-43280",
      "id": "CVE-2026-43280",
      "initial_release_date": "2026-05-09T02:39:45Z",
      "product_status:known_not_affected": "293",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-43280",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-43280.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.