---
id: CVE-2025-71076
title: 'drm/xe/oa: Limit num_syncs to prevent oversized allocations'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/xe/oa: Limit num_syncs to prevent oversized allocations

  The OA open parameters did not validate num_syncs, allowing
  userspace to pass arbitrarily large values, pot…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 803d418b73387fda392ddd83eace757ac25cf15d <
    b963636331fb4f3f598d80492e2fa834757198eb
  - >-
    Linux >= c8507a25cebd179db935dd266a33c51bef1b1e80 <
    338849090ee610ff6d11e5e90857d2c27a4121ab
  - >-
    Linux >= c8507a25cebd179db935dd266a33c51bef1b1e80 <
    f8dd66bfb4e184c71bd26418a00546ebe7f5c17a
  - Linux >= 6.12.17 < 6.12.64
  - Linux 6.13
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T21:14:04.935233Z'
published: '2026-01-13'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:23:08.345Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-71076'
references:
  - url: 'https://git.kernel.org/stable/c/b963636331fb4f3f598d80492e2fa834757198eb'
  - url: 'https://git.kernel.org/stable/c/338849090ee610ff6d11e5e90857d2c27a4121ab'
  - url: 'https://git.kernel.org/stable/c/f8dd66bfb4e184c71bd26418a00546ebe7f5c17a'
tags:
  - cve.org
epss: 0.00145
epssPercentile: 0.03753
ingestedAt: '2026-11-05T22:38:32.047Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/oa: Limit num_syncs to prevent oversized allocations

The OA open parameters did not validate num_syncs, allowing
userspace to pass arbitrarily large values, potentially
leading to excessive allocations.

Add check to ensure that num_syncs does not exceed DRM_XE_MAX_SYNCS,
returning -EINVAL when the limit is violated.

v2: use XE_IOCTL_DBG() and drop duplicated check. (Ashutosh)

(cherry picked from commit e057b2d2b8d815df3858a87dffafa2af37e5945b)

## Affected

- `Linux >= 803d418b73387fda392ddd83eace757ac25cf15d < b963636331fb4f3f598d80492e2fa834757198eb`
- `Linux >= c8507a25cebd179db935dd266a33c51bef1b1e80 < 338849090ee610ff6d11e5e90857d2c27a4121ab`
- `Linux >= c8507a25cebd179db935dd266a33c51bef1b1e80 < f8dd66bfb4e184c71bd26418a00546ebe7f5c17a`
- `Linux >= 6.12.17 < 6.12.64`
- `Linux 6.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.