CVE-2025-39741 drm/xe/migrate: don't overflow max copy size
An integer overflow in the Linux kernel's Xe GPU driver can cause a system assertion failure and crash when processing large non-page-aligned copy operations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-39741?
CVE-2025-39741 is a medium-severity vulnerability in Linux kernel, published on 11 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/xe/migrate: don't overflow max copy size
With non-page aligned copy, we need to use 4 byte aligned pitch, however the size itself might still be close to our maximum of ~8M, and so the dimensions of the copy can easily exceed the S16_MAX limit of the copy command leading to the following assert:
xe 0000:03:00.0: [drm] Assertion `size / pitch <= ((s16)(((u16)~0U) >> 1))` failed! platform: BATTLEMAGE subplatform: 1 graphics: Xe2_HPG 20.01 step A0 media: Xe2_HPM 13.01 step A1 tile: 0 VRAM 10.0 GiB GT: 0 type 1
WARNING: CPU: 23 PID: 10605 at drivers/gpu/drm/xe/xe_migrate.c:673 emit_copy+0x4b5/0x4e0 [xe]
To fix this account for the pitch when calculating the number of current bytes to copy.
(cherry picked from commit 8c2d61e0e916e077fda7e7b8e67f25ffe0f361fc)
Which versions are affected by CVE-2025-39741?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-39741?
Apply the vendor's patch.
Is CVE-2025-39741 being exploited?
There is no known exploitation of CVE-2025-39741 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-39741, GHSA-wh8m-6mqf-wcpv, UBUNTU-CVE-2025-39741.