CVE-2026-68267

A flaw was found in the drm/xe/rtp component of the Linux kernel. This vulnerability arises from the unconditional whitelisting of Output/Availability (OA) registers, which is a security violation. By default, these registers could be whitelisted after system events such as probe, graphics translation (gt) reset, resume, and engine reset. This improper whitelisting could allow a local attacker to gain unauthorized access to privileged OA registers, potentially leading to a security bypass or information disclosure.

OA MMIO trigger and status registers in the Intel Xe driver were incorrectly placed in the nonprivileged register whitelist. A local user able to submit GPU work through the render node or an equivalent GPU interface could gain access to registers that should remain denied by default after probe, gt reset, resume, or engine reset. For the CVSS the PR:L is used because reliable triggering requires local access to a GPU execution interface, but not full administrator privileges. The issue is not network reachable and there is no evidence of kernel memory corruption or a direct privilege escalation primitive. Impact is mainly a local access control bypass with possible low confidentiality and integrity impact through unauthorized OA register access.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.