In the Linux kernel, the following vulnerability has been resolved:
drm/xe: Fix an out-of-bounds shift when invalidating TLB
When the size of the range invalidated is larger than rounddown_pow_of_two(ULONG_MAX), The function macro roundup_pow_of_two(length) will hit an out-of-bounds shift [1].
Use a full TLB invalidation for such cases. v2: - Use a define for the range size limit over which we use a full TLB invalidation. (Lucas) - Use a better calculation of the limit.
[1]: [ 39.202421] ------------[ cut here ]------------ [ 39.202657] UBSAN: shift-out-of-bounds in ./include/linux/log2.h:57:13 [ 39.202673] shift exponent 64 is too large for 64-bit type 'long unsigned int' [ 39.202688] CPU: 8 UID: 0 PID: 3129 Comm: xe_exec_system_ Tainted: G U 6.14.0+ #10 [ 39.202690] Tainted: [U]=USER [ 39.202690] Hardware name: ASUS System Product Name/PRIME B560M-A AC, BIOS 2001 02/01/2023 [ 39.202691] Call Trace: [ 39.202692] <TASK> [ 39.202695] dump_stack_lvl+0x6e/0xa0 [ 39.202699] ubsan_epilogue+0x5/0x30 [ 39.202701] __ubsan_handle_shift_out_of_bounds.cold+0x61/0xe6 [ 39.202705] xe_gt_tlb_invalidation_range.cold+0x1d/0x3a [xe] [ 39.202800] ? find_held_lock+0x2b/0x80 [ 39.202803] ? mark_held_locks+0x40/0x70 [ 39.202806] xe_svm_invalidate+0x459/0x700 [xe] [ 39.202897] drm_gpusvm_notifier_invalidate+0x4d/0x70 [drm_gpusvm] [ 39.202900] __mmu_notifier_release+0x1f5/0x270 [ 39.202905] exit_mmap+0x40e/0x450 [ 39.202912] __mmput+0x45/0x110 [ 39.202914] exit_mm+0xc5/0x130 [ 39.202916] do_exit+0x21c/0x500 [ 39.202918] ? lockdep_hardirqs_on_prepare+0xdb/0x190 [ 39.202920] do_group_exit+0x36/0xa0 [ 39.202922] get_signal+0x8f8/0x900 [ 39.202926] arch_do_signal_or_restart+0x35/0x100 [ 39.202930] syscall_exit_to_user_mode+0x1fc/0x290 [ 39.202932] do_syscall_64+0xa1/0x180 [ 39.202934] ? do_user_addr_fault+0x59f/0x8a0 [ 39.202937] ? lock_release+0xd2/0x2a0 [ 39.202939] ? do_user_addr_fault+0x5a9/0x8a0 [ 39.202942] ? trace_hardirqs_off+0x4b/0xc0 [ 39.202944] ? clear_bhb_loop+0x25/0x80 [ 39.202946] ? clear_bhb_loop+0x25/0x80 [ 39.202947] ? clear_bhb_loop+0x25/0x80 [ 39.202950] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 39.202952] RIP: 0033:0x7fa945e543e1 [ 39.202961] Code: Unable to access opcode bytes at 0x7fa945e543b7. [ 39.202962] RSP: 002b:00007ffca8fb4170 EFLAGS: 00000293 [ 39.202963] RAX: 000000000000003d RBX: 0000000000000000 RCX: 00007fa945e543e3 [ 39.202964] RDX: 0000000000000000 RSI: 00007ffca8fb41ac RDI: 00000000ffffffff [ 39.202964] RBP: 00007ffca8fb4190 R08: 0000000000000000 R09: 00007fa945f600a0 [ 39.202965] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 [ 39.202966] R13: 00007fa9460dd310 R14: 00007ffca8fb41ac R15: 0000000000000000 [ 39.202970] </TASK> [ 39.202970] ---[ end trace ]---
(cherry picked from commit b88f48f86500bc0b44b4f73ac66d500a40d320ad)
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Redhat_linux | — | No solution existsUpgrade kernel-rtUpgrade kernel | Jul 9, 2025 | May 1, 2025 |
| Suse | — | Upgrade kernel-defaultUpgrade kernel-devel-azureUpgrade kernel-obs-qaUpgrade kernel-azure-vdsoUpgrade kernel-macrosUpgrade kernel-default-extraUpgrade kernel-docs-htmlUpgrade kernel-default-baseUpgrade kernel-kvmsmallUpgrade kernel-kvmsmall-develUpgrade kernel-kvmsmall-vdsoUpgrade kernel-zfcpdumpUpgrade kernel-azure-extraUpgrade kernel-azure-develUpgrade kernel-docsUpgrade kernel-obs-buildUpgrade kernel-azureUpgrade kernel-64kb-extraUpgrade kernel-default-vdsoUpgrade kernel-64kb-develUpgrade kernel-develUpgrade kernel-source-vanillaUpgrade kernel-sourceUpgrade reiserfs-kmp-defaultUpgrade kernel-symsUpgrade kernel-default-develUpgrade kernel-default-livepatchUpgrade kernel-64kbUpgrade kernel-syms-azureUpgrade kernel-source-azure | Dec 5, 2025 | Jul 8, 2025 |
| Ubuntu | — | Upgrade linux-image-gcp-64kUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.8.1-1041-realtimeUpgrade linux-image-ibmUpgrade linux-image-6.8.0-1046-aws-fipsUpgrade linux-image-aws-64k-6.8Upgrade linux-image-aws-fipsUpgrade linux-image-6.8.0-100-lowlatencyUpgrade linux-image-generic-64k-6.8Upgrade linux-image-6.8.0-1046-nvidia-lowlatencyUpgrade linux-image-6.8.0-100-genericUpgrade linux-image-generic-6.8Upgrade linux-image-6.8.0-1046-awsUpgrade linux-image-raspiUpgrade linux-image-nvidia-6.8Upgrade linux-image-realtime-6.8.1Upgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-6.8.0-1044-ibmUpgrade linux-image-aws-6.8Upgrade linux-image-fipsUpgrade linux-image-oem-22.04aUpgrade linux-image-6.14.0-1007-raspiUpgrade linux-image-ibm-classicUpgrade linux-image-oracle-6.8Upgrade linux-image-6.8.0-1043-gke-64kUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-oem-22.04bUpgrade linux-image-aws-lts-24.04Upgrade linux-image-virtual-6.8Upgrade linux-image-6.8.0-1047-gcp-64kUpgrade linux-image-6.14.0-1007-oracle-64kUpgrade linux-image-raspi-realtime-6.8Upgrade linux-image-azure-fdeUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-azureUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-lowlatency-6.8Upgrade linux-image-6.8.0-100-generic-64kUpgrade linux-image-6.8.0-100-lowlatency-64kUpgrade linux-image-6.14.0-1007-awsUpgrade linux-image-6.8.0-1023-xilinxUpgrade linux-image-gke-64k-6.8Upgrade linux-image-kvmUpgrade linux-image-azure-fipsUpgrade linux-image-azure-lts-24.04Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-fips-6.8Upgrade linux-image-6.14.0-1007-aws-64kUpgrade linux-image-gke-64kUpgrade linux-image-xilinx-6.8Upgrade linux-image-gcp-fipsUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.14.0-22-genericUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-lowlatencyUpgrade linux-image-6.8.0-1047-gcp-fipsUpgrade linux-image-ibm-6.8Upgrade linux-image-aws-fips-6.8Upgrade linux-image-awsUpgrade linux-image-6.14.0-1008-gcpUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-oracle-64k-6.8Upgrade linux-image-raspi-6.8Upgrade linux-image-gkeop-6.8Upgrade linux-image-6.8.0-1043-oracle-64kUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-gcp-64k-6.8Upgrade linux-image-6.8.0-1043-gkeUpgrade linux-image-6.8.0-1051-azureUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-nvidia-64kUpgrade linux-image-gcp-6.8Upgrade linux-image-oracleUpgrade linux-image-intel-iot-realtimeUpgrade linux-image-aws-64kUpgrade linux-image-6.8.0-1046-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1047-gcpUpgrade linux-image-lowlatency-64kUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-generic-64kUpgrade linux-image-azure-6.8Upgrade linux-image-6.8.0-2037-raspi-realtimeUpgrade linux-image-6.8.0-1047-raspiUpgrade linux-image-6.8.0-1046-nvidiaUpgrade linux-image-6.8.0-1030-gkeopUpgrade linux-image-6.14.0-22-generic-64kUpgrade linux-image-6.14.0-1007-oracleUpgrade linux-image-6.14.0-1007-azure-fdeUpgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-realtime-hwe-22.04Upgrade linux-image-6.8.0-1046-nvidia-64kUpgrade linux-image-6.8.0-100-fipsUpgrade linux-image-raspi-realtimeUpgrade linux-image-generic-lpaeUpgrade linux-image-genericUpgrade linux-image-oem-22.04cUpgrade linux-image-oem-22.04dUpgrade linux-image-gke-6.8Upgrade linux-image-xilinxUpgrade linux-image-gkeUpgrade linux-image-virtualUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-nvidiaUpgrade linux-image-gcpUpgrade linux-image-6.14.0-1004-realtimeUpgrade linux-image-6.8.0-1046-azure-fipsUpgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-oracle-64kUpgrade linux-image-intel-iotgUpgrade linux-image-oem-22.04Upgrade linux-image-6.14.0-1008-gcp-64kUpgrade linux-image-azure-fips-6.8Upgrade linux-image-6.8.0-1043-oracleUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-realtimeUpgrade linux-image-gkeopUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-6.14.0-1007-azureUpgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-6.8.0-1046-aws-64kUpgrade linux-image-6.8.0-1046-azureUpgrade linux-image-gcp-fips-6.8 | Jun 26, 2025 | May 1, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub