Executive brief
A vulnerability in the Linux kernel's Intel graphics driver could allow a malicious virtual machine to access memory belonging to other virtual machines or the host system. This occurs because the system fails to clear old data when setting up memory translation tables for graphics hardware. An attacker with local access to a guest virtual machine could exploit this to steal sensitive information or interfere with the operations of the host and other users.
Technical details
A vulnerability in the 'drm/xe/pf' component of the Linux kernel arises because Local Memory (LMEM) buffer objects used for Local Memory Translation Tables (LMTT) are not zeroed upon allocation. During SR-IOV Virtual Function (VF) provisioning, only the Page Table Entries (PTEs) for the specifically assigned range are initialized, leaving stale data in the remaining LMTT pages. A malicious VF could leverage these uncleared PTEs to access memory ranges belonging to other VFs or the Physical Function (PF). The fix involves explicitly clearing all new LMTT pages using 'xe_map_memset' during allocation in 'xe_lmtt.c'.
Affected products
- Linux Linux Kernel 6.8 to 6.12.38, 6.13 to 6.15.6
Timeline
- 2025-08-16: disclosed: Initial publication of the CVE record
- 2025-07-17: patched: Fix committed to stable kernel branches