CVE-2026-43280 drm/xe: Add bounds check on pat_index to prevent OOB kernel read in madvise
A local attacker can trigger an out-of-bounds kernel read via the madvise IOCTL in the Intel Xe driver, potentially exposing sensitive kernel memory.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43280?
CVE-2026-43280 is a high-severity vulnerability in Linux kernel, published on 6 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/xe: Add bounds check on pat_index to prevent OOB kernel read in madvise
When user provides a bogus pat_index value through the madvise IOCTL, the xe_pat_index_get_coh_mode() function performs an array access without validating bounds. This allows a malicious user to trigger an out-of-bounds kernel read from the xe->pat.table array.
The vulnerability exists because the validation in madvise_args_are_sane() directly calls xe_pat_index_get_coh_mode(xe, args->pat_index.val) without first checking if pat_index is within [0, xe->pat.n_entries).
Although xe_pat_index_get_coh_mode() has a WARN_ON to catch this in debug builds, it still performs the unsafe array access in production kernels.
v2(Matthew Auld) - Using array_index_nospec() to mitigate spectre attacks when the value is used
v3(Matthew Auld) - Put the declarations at the start of the block
(cherry picked from commit 944a3329b05510d55c69c2ef455136e2fc02de29)
Weakness: CWE-125
Which versions are affected by CVE-2026-43280?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43280?
Apply the vendor's patch.
Is CVE-2026-43280 being exploited?
There is no known exploitation of CVE-2026-43280 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-43280, DEBIAN-CVE-2026-43280, GHSA-cmxm-m5w5-f84q, UBUNTU-CVE-2026-43280.