CVE-2026-68267

What it actually does

The vulnerability permits unconditional whitelisting of OA registers in the drm/xe driver after probe, GT reset, resume, and engine reset events because the RING_FORCE_TO_NONPRIV_DENY bit is not set in OA non-privileged slots, bypassing intended access controls.

Why it matters to the business

Systems running affected kernels face elevated risk of unauthorized GPU register access that could expose performance counters or enable further attacks; the low and declining exploit probability combined with absence from known campaigns reduces immediate urgency but still requires kernel updates within normal patching cycles.

How an attack unfolds

An attacker with local unprivileged access triggers a GPU reset or resumes the system, then uses the default-whitelisted OA registers to read or write protected observation architecture state without the expected privilege checks.

How to fix it

Upgrade the Linux kernel to a version containing commit 90511bdcfda97211c01f1d945d4ea616578d8fca (or its backports) so that RING_FORCE_TO_NONPRIV_DENY is unconditionally set for OA slots.

How to confirm the fix worked

Confirm the presence of the RING_FORCE_TO_NONPRIV_DENY setting in the OA non-priv whitelist initialization code after the listed events, or verify the kernel commit hash in the running kernel source.

Typical attack path

1. Obtain local shell or userland execution on a Linux system using the xe driver
2. Trigger a GT reset, engine reset, suspend/resume, or initial probe
3. Access OA registers that were incorrectly added to the non-privileged whitelist
4. Read sensitive performance data or manipulate state to facilitate further exploitation

How to detect it

Search kernel audit logs or system call traces for unexpected accesses to OA register ranges immediately following GPU resets or resume events; no named threat actors or ransomware use are associated with this issue.

What your security team should do

• Prioritize kernel updates during the next scheduled maintenance window given the 76-day publication age and low EPSS
• Monitor upstream stable and distribution kernel changelogs for the referenced commit
• Review graphics driver configurations for any custom OA register handling