In the Linux kernel, the following vulnerability has been resolved:
drm/xe/migrate: don't overflow max copy size
With non-page aligned copy, we need to use 4 byte aligned pitch, however
the size itself might still be close to our maximum of ~8M, and so the
dimensions of the copy can easily exceed the S16_MAX limit of the copy
command leading to the following assert:
xe 0000:03:00.0: [drm] Assertion `size / pitch <= ((s16)(((u16)~0U) >> 1))` failed!
platform: BATTLEMAGE subplatform: 1
graphics: Xe2_HPG 20.01 step A0
media: Xe2_HPM 13.01 step A1
tile: 0 VRAM 10.0 GiB
GT: 0 type 1
WARNING: CPU: 23 PID: 10605 at drivers/gpu/drm/xe/xe_migrate.c:673 emit_copy+0x4b5/0x4e0 [xe]
To fix this account for the pitch when calculating the number of current
bytes to copy.
(cherry picked from commit 8c2d61e0e916e077fda7e7b8e67f25ffe0f361fc)
References
Configurations
Configuration 1 (hide)
|
History
25 Nov 2025, 21:08
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:* |
|
| First Time |
Linux linux Kernel
Linux |
|
| CWE | NVD-CWE-noinfo | |
| References | () https://git.kernel.org/stable/c/4126cb327a2e3273c81fcef1c594c5b7b645c44c - Patch | |
| References | () https://git.kernel.org/stable/c/7257cc6644d540130a46a61531a07a0517cace89 - Patch | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
Information
Published : 2025-09-11 17:15
Updated : 2025-11-25 21:08
NVD link : CVE-2025-39741
Mitre link : CVE-2025-39741
CVE.ORG link : CVE-2025-39741
JSON object : View
Products Affected
linux
- linux_kernel
CWE