{"cve":"CVE-2026-68305","nvd":{"published":"2026-08-10T13:20:20.193","modified":"2026-10-19T22:17:12.710","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers\n\nCCS read/write buffers are freed during BO destruction. In some cases,\nBOs may be destroyed after the device is unbound but while the DRM\nstructure remains valid, leading to NULL pointer dereferences when\naccessing device resources.\n\nBUG: kernel NULL pointer dereference, address: 0000000000000000\nPGD 0 P4D 0\nOops: Oops: 0000 [#1] SMP NOPTI\nCPU: 0 UID: 0 PID: 9376 Comm: xe_pat Not tainted 7.2.0-rc2+ #1 PREEMPT(lazy)\nRIP: 0010:xe_sriov_vf_ccs_rw_update_bb_addr+0x4d/0xa0 [xe]\nRSP: 0018:ffffcf304110b9c8 EFLAGS: 00010246\nRAX: ffff8a85c38a0a00 RBX: 00000000810ef000 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8a85c39c1888\nRBP: ffffcf304110b9e8 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: ffff8a85c39c1888\nR13: 0000000000000000 R14: ffff8a85c39b4f28 R15: ffff8a85c3885000\nFS:  0000000000000000(0000) GS:ffff8a878b809000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000000 CR3: 000000010314a002 CR4: 0000000000772ef0\nPKRU: 55555554\nCall Trace:\n <TASK>\n xe_migrate_ccs_rw_copy_clear+0x98/0x120 [xe]\n xe_sriov_vf_ccs_detach_bo+0x2c/0x60 [xe]\n xe_ttm_bo_delete_mem_notify+0xc8/0xe0 [xe]\n ttm_bo_cleanup_memtype_use+0x26/0x80 [ttm]\n ttm_bo_release+0x29e/0x2d0 [ttm]\n ttm_bo_fini+0x39/0x70 [ttm]\n xe_gem_object_free+0x1f/0x30 [xe]\n drm_gem_object_free+0x1d/0x40\n ttm_bo_vm_close+0x5f/0x90 [ttm]\n remove_vma+0x2c/0x70\n tear_down_vmas+0x63/0xf0\n exit_mmap+0x20d/0x3f0\n __mmput+0x45/0x170\n mmput+0x31/0x40\n do_exit+0x2ba/0xac0\n do_group_exit+0x2d/0xb0\n __x64_sys_exit_group+0x18/0x20\n x64_sys_call+0x14a0/0x2390\n do_syscall_64+0xdd/0x640\n ? count_memcg_events+0xea/0x240\n ? handle_mm_fault+0x1ec/0x2f0\n\n(cherry picked from commit 1ae415a6eefe5004954a1d352b1718faca8844ef)","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8},"cwes":["CWE-476"],"references":["https://git.kernel.org/stable/c/0c07e046e639160a1597830c4c5615ee2a4a5ed5","https://git.kernel.org/stable/c/4c92afb4c143526d340545ca581e88e6952ea511","https://git.kernel.org/stable/c/523ed2831ee55b2a1edabdea96781651f9df9685"],"products":[],"source":"nvd","synced_at":"2026-10-21T03:56:58.798400159+00:00"},"epss":{"cve":"CVE-2026-68305","score":0.00173,"percentile":0.06725,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}