{"id":"CVE-2026-43280","title":"drm/xe: Add bounds check on pat_index to prevent OOB kernel read in madvise","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Add bounds check on pat_index to prevent OOB kernel read in madvise\n\nWhen user provides a bogus pat_index value through the madvise IOCTL, the\nxe_pat_index_get_…","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= ada7486c5668db542a7d361268df931aca5b726a < ffba51100ff61792fefbae11ca38ac1987a818dd","Linux >= ada7486c5668db542a7d361268df931aca5b726a < 79f52655567a6471ff3d0d6325ede91bb14461f4","Linux >= ada7486c5668db542a7d361268df931aca5b726a < fbbe32618e97eff81577a01eb7d9adcd64a216d7","Linux 6.18"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-16T15:16:15.978847Z"},"published":"2026-05-06","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:20:38.345Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-43280","references":[{"url":"https://git.kernel.org/stable/c/ffba51100ff61792fefbae11ca38ac1987a818dd"},{"url":"https://git.kernel.org/stable/c/79f52655567a6471ff3d0d6325ede91bb14461f4"},{"url":"https://git.kernel.org/stable/c/fbbe32618e97eff81577a01eb7d9adcd64a216d7"}],"tags":["cve.org"],"epss":0.00164,"epssPercentile":0.05254,"ingestedAt":"2026-10-16T17:24:46.690Z","slug":"CVE-2026-43280","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Add bounds check on pat_index to prevent OOB kernel read in madvise\n\nWhen user provides a bogus pat_index value through the madvise IOCTL, the\nxe_pat_index_get_coh_mode() function performs an array access without\nvalidating bounds. This allows a malicious user to trigger an out-of-bounds\nkernel read from the xe->pat.table array.\n\nThe vulnerability exists because the validation in madvise_args_are_sane()\ndirectly calls xe_pat_index_get_coh_mode(xe, args->pat_index.val) without\nfirst checking if pat_index is within [0, xe->pat.n_entries).\n\nAlthough xe_pat_index_get_coh_mode() has a WARN_ON to catch this in debug\nbuilds, it still performs the unsafe array access in production kernels.\n\nv2(Matthew Auld)\n- Using array_index_nospec() to mitigate spectre attacks when the value\nis used\n\nv3(Matthew Auld)\n- Put the declarations at the start of the block\n\n(cherry picked from commit 944a3329b05510d55c69c2ef455136e2fc02de29)\n\n## Affected\n\n- `Linux >= ada7486c5668db542a7d361268df931aca5b726a < ffba51100ff61792fefbae11ca38ac1987a818dd`\n- `Linux >= ada7486c5668db542a7d361268df931aca5b726a < 79f52655567a6471ff3d0d6325ede91bb14461f4`\n- `Linux >= ada7486c5668db542a7d361268df931aca5b726a < fbbe32618e97eff81577a01eb7d9adcd64a216d7`\n- `Linux 6.18`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}