CVE-2025-68802: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68802 is a vulnerability in the Linux kernel's DRM/Xe (Intel Xe GPU) driver that allows a local user to trigger excessively large kernel memory allocations by supplying an unbounded num_syncs value via the exec or vm_bind ioctl interfaces. Without bounds checking, this causes kernel warnings from the page allocator and can lead to denial-of-service conditions. The fix introduces DRM_XE_MAX_SYNCS (set to 1024) to reject oversized requests. It was published on January 13, 2026, and carries a CVSS category estimate of Medium (Feedly).

The root cause is a missing input validation check (CWE-400: Uncontrolled Resource Consumption) in the Linux kernel's xe_exec_ioctl() function within drivers/gpu/drm/xe/xe_exec.c. When userspace passes a very large num_syncs value to the exec or vm_bind ioctl, the kernel calls kmalloc_array_noprof() to allocate a correspondingly large buffer without any upper bound check, triggering page allocator warnings and potential OOM conditions. The call trace shows the allocation path: xe_exec_ioctl → __kmalloc_noprof → kmalloc_array_noprof → ___kmalloc_large_node → alloc_pages_mpol. The fix caps num_syncs at 1024 via the new DRM_XE_MAX_SYNCS constant (Feedly).

Successful exploitation allows a local, unprivileged user with access to the DRM/Xe device node to cause kernel page allocator warnings and potentially exhaust system memory, resulting in a denial-of-service condition. The vulnerability affects availability of the system; there is no direct evidence of confidentiality or integrity impact. Systems running Intel Xe GPU hardware with the affected kernel driver are at risk (Feedly).

1. Gain local access: Obtain a local user account on a Linux system with an Intel Xe GPU and access to the DRM device node (e.g., /dev/dri/renderD128).
2. Open the DRM device: Open the Xe DRM device file descriptor using open("/dev/dri/renderD128", O_RDWR).
3. Craft malicious ioctl: Prepare a drm_xe_exec or vm_bind structure with an extremely large num_syncs value (e.g., UINT_MAX or another value exceeding 1024).
4. Invoke the ioctl: Call ioctl(fd, DRM_IOCTL_XE_EXEC, &exec_args) with the crafted structure.
5. Trigger oversized allocation: The kernel attempts to allocate a buffer proportional to num_syncs without bounds checking, causing page allocator warnings and potential system instability or OOM (Feedly).

• Logs: Kernel log messages containing WARNING: CPU: ... at mm/page_alloc.c:5124 __alloc_frozen_pages_noprof with a call trace including xe_exec_ioctl and kmalloc_array_noprof.
• Logs: Repeated kernel OOM or page allocation failure messages associated with the drm or xe subsystem.
• Process: Unusual processes repeatedly opening /dev/dri/renderD* device nodes and invoking DRM ioctls with abnormal parameters.
• System: Sudden spikes in kernel memory usage or system slowdowns on hosts with Intel Xe GPUs (Feedly).

Apply the upstream Linux kernel patches that introduce DRM_XE_MAX_SYNCS = 1024 to bound the num_syncs parameter in xe_exec_ioctl(). Fixes are referenced in kernel stable commits 1d200017f55f, 8e461304009135, and e281d1fd6903. Distribution-specific updates have been issued by Ubuntu (USN-8177-1, USN-8177-2, USN-8183-1, USN-8183-2, USN-8245-1, USN-8257-1), Debian (DSA-6126-1), and SUSE. As a workaround where patching is not immediately possible, restrict access to DRM device nodes to trusted users only (Ubuntu Security, Feedly).