CVE-2026-68305

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers<br /> <br /> CCS read/write buffers are freed during BO destruction. In some cases,<br /> BOs may be destroyed after the device is unbound but while the DRM<br /> structure remains valid, leading to NULL pointer dereferences when<br /> accessing device resources.<br /> <br /> BUG: kernel NULL pointer dereference, address: 0000000000000000<br /> PGD 0 P4D 0<br /> Oops: Oops: 0000 [#1] SMP NOPTI<br /> CPU: 0 UID: 0 PID: 9376 Comm: xe_pat Not tainted 7.2.0-rc2+ #1 PREEMPT(lazy)<br /> RIP: 0010:xe_sriov_vf_ccs_rw_update_bb_addr+0x4d/0xa0 [xe]<br /> RSP: 0018:ffffcf304110b9c8 EFLAGS: 00010246<br /> RAX: ffff8a85c38a0a00 RBX: 00000000810ef000 RCX: 0000000000000000<br /> RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8a85c39c1888<br /> RBP: ffffcf304110b9e8 R08: 0000000000000000 R09: 0000000000000000<br /> R10: 0000000000000000 R11: 0000000000000000 R12: ffff8a85c39c1888<br /> R13: 0000000000000000 R14: ffff8a85c39b4f28 R15: ffff8a85c3885000<br /> FS: 0000000000000000(0000) GS:ffff8a878b809000(0000) knlGS:0000000000000000<br /> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033<br /> CR2: 0000000000000000 CR3: 000000010314a002 CR4: 0000000000772ef0<br /> PKRU: 55555554<br /> Call Trace:<br /> <br /> xe_migrate_ccs_rw_copy_clear+0x98/0x120 [xe]<br /> xe_sriov_vf_ccs_detach_bo+0x2c/0x60 [xe]<br /> xe_ttm_bo_delete_mem_notify+0xc8/0xe0 [xe]<br /> ttm_bo_cleanup_memtype_use+0x26/0x80 [ttm]<br /> ttm_bo_release+0x29e/0x2d0 [ttm]<br /> ttm_bo_fini+0x39/0x70 [ttm]<br /> xe_gem_object_free+0x1f/0x30 [xe]<br /> drm_gem_object_free+0x1d/0x40<br /> ttm_bo_vm_close+0x5f/0x90 [ttm]<br /> remove_vma+0x2c/0x70<br /> tear_down_vmas+0x63/0xf0<br /> exit_mmap+0x20d/0x3f0<br /> __mmput+0x45/0x170<br /> mmput+0x31/0x40<br /> do_exit+0x2ba/0xac0<br /> do_group_exit+0x2d/0xb0<br /> __x64_sys_exit_group+0x18/0x20<br /> x64_sys_call+0x14a0/0x2390<br /> do_syscall_64+0xdd/0x640<br /> ? count_memcg_events+0xea/0x240<br /> ? handle_mm_fault+0x1ec/0x2f0<br /> <br /> (cherry picked from commit 1ae415a6eefe5004954a1d352b1718faca8844ef)