CVE-2026-43280

In the Linux kernel, the following vulnerability has been resolved:

drm/xe: Add bounds check on pat_index to prevent OOB kernel read in madvise

When user provides a bogus patindex value through the madvise IOCTL, the xepatindexgetcohmode() function performs an array access without validating bounds. This allows a malicious user to trigger an out-of-bounds kernel read from the xe->pat.table array.

The vulnerability exists because the validation in madviseargsaresane() directly calls xepatindexgetcohmode(xe, args->patindex.val) without first checking if patindex is within [0, xe->pat.n_entries).

Although xepatindexgetcohmode() has a WARNON to catch this in debug builds, it still performs the unsafe array access in production kernels.

v2(Matthew Auld) - Using arrayindexnospec() to mitigate spectre attacks when the value is used

v3(Matthew Auld) - Put the declarations at the start of the block

(cherry picked from commit 944a3329b05510d55c69c2ef455136e2fc02de29)