LiveActive security incident?Get immediate response
CVE Record

CVE-2025-68802: drm/xe: Limit num_syncs to prevent oversized allocations

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Limit num_syncs to prevent oversized allocations The exec and vm_bind ioctl allow userspace to specify an arbitrary num_syncs value. Without bounds checking, a very large num_syncs can force an excessively large allocation, leading to kernel warnings from the page allocator as below. Introduce DRM_XE_MAX_SYNCS (set to 1024) and reject any request exceeding this limit. " ------------[ cut here ]------------ WARNING: CPU: 0 PID: 1217 at mm/page_alloc.c:5124 __alloc_frozen_pages_noprof+0x2f8/0x2180 mm/page_alloc.c:5124 ... Call Trace: <TASK> alloc_pages_mpol+0xe4/0x330 mm/mempolicy.c:2416 ___kmalloc_large_node+0xd8/0x110 mm/slub.c:4317 __kmalloc_large_node_noprof+0x18/0xe0 mm/slub.c:4348 __do_kmalloc_node mm/slub.c:4364 [inline] __kmalloc_noprof+0x3d4/0x4b0 mm/slub.c:4388 kmalloc_noprof include/linux/slab.h:909 [inline] kmalloc_array_noprof include/linux/slab.h:948 [inline] xe_exec_ioctl+0xa47/0x1e70 drivers/gpu/drm/xe/xe_exec.c:158 drm_ioctl_kernel+0x1f1/0x3e0 drivers/gpu/drm/drm_ioctl.c:797 drm_ioctl+0x5e7/0xc50 drivers/gpu/drm/drm_ioctl.c:894 xe_drm_ioctl+0x10b/0x170 drivers/gpu/drm/xe/xe_device.c:224 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:598 [inline] __se_sys_ioctl fs/ioctl.c:584 [inline] __x64_sys_ioctl+0x18b/0x210 fs/ioctl.c:584 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xbb/0x380 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f ... " v2: Add "Reported-by" and Cc stable kernels. v3: Change XE_MAX_SYNCS from 64 to 1024. (Matt & Ashutosh) v4: s/XE_MAX_SYNCS/DRM_XE_MAX_SYNCS/ (Matt) v5: Do the check at the top of the exec func. (Matt) (cherry picked from commit b07bac9bd708ec468cd1b8a5fe70ae2ac9b0a11c)

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2025-68802 is a Linux kernel issue in the Intel Xe DRM graphics driver. Local userspace could request an excessively large synchronization array through GPU-related ioctls, causing oversized kernel memory allocations and allocator warnings. The provided sources do not show remote exploitation, privilege escalation, or active exploitation.

Executive priority

Treat this as a routine-to-priority kernel patching item, higher for shared workstations, VDI, CI, or container hosts with local untrusted users and Intel Xe graphics exposure. No supplied evidence supports emergency response for active exploitation.

Technical view

The drm/xe exec and vm_bind ioctl paths accepted an arbitrary num_syncs value. A very large value could drive kmalloc_array into excessive allocation behavior in xe_exec_ioctl. The fix adds DRM_XE_MAX_SYNCS, set to 1024, and rejects requests above that limit.

Likely exposure

Exposure is most likely on Linux systems using affected kernel versions with the drm/xe driver available to local userspace. Systems without Intel Xe driver use, or without local untrusted users, have lower apparent exposure based on the supplied evidence.

Exploitation context

The source describes local userspace input through exec and vm_bind ioctls causing oversized allocations. KEV is false, and the provided bundle does not cite public exploitation, exploit code, remote attack paths, or confirmed crash impact beyond kernel allocator warnings.

Researcher notes

Key evidence is the upstream kernel fix description and stable commits. Affected-version data is incomplete and oddly duplicated in the bundle, so rely on vendor kernel advisories for precise applicability. Avoid assuming broader impact than oversized allocation warnings without additional source evidence.

Mitigation direction

  • Apply vendor kernel updates containing the referenced stable fixes.
  • Prioritize systems exposing drm/xe to untrusted local users or workloads.
  • Check distribution advisories for backported fixes and exact package versions.
  • If patching is delayed, review vendor guidance for limiting local GPU device access.

Validation and detection

  • Inventory Linux kernel versions and confirm whether drm/xe is present or loaded.
  • Check distribution changelogs for the DRM_XE_MAX_SYNCS fix.
  • Verify patched kernels reject num_syncs values above 1024.
  • Review local access to GPU device nodes on multi-user systems.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-68802 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
4Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxdd08ebf6c3525a7ea2186e636df064ea47281987, dd08ebf6c3525a7ea2186e636df064ea47281987, dd08ebf6c3525a7ea2186e636df064ea47281987unaffected
LinuxLinux6.8, 0, 6.12.64, 6.18.3, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.