CVE-2025-68802

What it actually does

The exec and vm_bind ioctls in the Linux kernel drm/xe driver accept an unbounded num_syncs value from userspace, allowing an arbitrarily large allocation via kmalloc_array that triggers page allocator warnings and potential resource exhaustion.

Why it matters to the business

Systems using Intel Xe graphics hardware may experience kernel warnings, reduced stability, or denial-of-service conditions when untrusted applications issue crafted graphics commands; the issue affects a wide range of Linux distributions and kernels published after the vulnerability window.

How an attack unfolds

An attacker with access to the DRM device node crafts an ioctl request containing an excessively large num_syncs parameter; this reaches xe_exec_ioctl without bounds checking, causing an oversized kmalloc that triggers allocator warnings visible in kernel logs.

How to fix it

Update the Linux kernel to a version containing commit e281d1fd6903a081ef023c341145ae92258e38d2 or later; the fix introduces DRM_XE_MAX_SYNCS set to 1024 and rejects larger values at the start of the exec handler.

How to confirm the fix worked

Confirm the running kernel contains commit e281d1fd6903a081ef023c341145ae92258e38d2; test by attempting an ioctl with num_syncs=1025 and verify the request is rejected before allocation.

Typical attack path

1. Obtain access to a system with the vulnerable drm/xe driver loaded
2. Open the DRM device file descriptor
3. Invoke the exec or vm_bind ioctl supplying num_syncs greater than 1024
4. Observe kernel page allocator warnings and potential follow-on instability

How to detect it

Review kernel logs for page allocator warnings containing __alloc_frozen_pages_noprof and call traces that include xe_exec_ioctl or drm_ioctl_kernel; correlate with processes issuing DRM ioctls.

What your security team should do

• Prioritize kernel updates on all systems exposing the Xe DRM device to untrusted users
• Monitor kernel logs for page allocator warnings referencing xe_exec_ioctl or __kmalloc_large_node
• Restrict DRM device access via permissions or SELinux/AppArmor until patches are applied