CVE-2026-68267: drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists

Unconditionally whitelisting OA registers is a security violation. Set
RING_FORCE_TO_NONPRIV_DENY bit in OA nonpriv slots, so that OA registers
don't get whitelisted by default after probe, gt reset, resume and engine
reset.

(cherry picked from commit 90511bdcfda97211c01f1d945d4ea616578d8fca)

The Linux kernel CVE team has assigned CVE-2026-68267 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.11 with commit 828a8eaf37c3fac6ba048995f55f1647a4ac542d and fixed in 6.12.103 with commit 9852aa87ecba95d7bf9fb94a9d6c4f69312c9682
	Issue introduced in 6.11 with commit 828a8eaf37c3fac6ba048995f55f1647a4ac542d and fixed in 6.18.44 with commit 7982678fa21eda02a9111d2646be6762b5e3a64d
	Issue introduced in 6.11 with commit 828a8eaf37c3fac6ba048995f55f1647a4ac542d and fixed in 7.1.6 with commit 1e6d07abbc0c41cb3259042794ad3deca79dd14e
	Issue introduced in 6.11 with commit 828a8eaf37c3fac6ba048995f55f1647a4ac542d and fixed in 7.2-rc2 with commit e70086a3a06d276b4a5d9a2c51c9330c6cf72780

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-68267
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/gpu/drm/xe/xe_reg_whitelist.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/9852aa87ecba95d7bf9fb94a9d6c4f69312c9682
	https://git.kernel.org/stable/c/7982678fa21eda02a9111d2646be6762b5e3a64d
	https://git.kernel.org/stable/c/1e6d07abbc0c41cb3259042794ad3deca79dd14e
	https://git.kernel.org/stable/c/e70086a3a06d276b4a5d9a2c51c9330c6cf72780