CVE-2026-72358

Received Received - Intake

Null Pointer Dereference in Linux Kernel DRM/XE

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: prevent invalid cursor access for purged BOs During a page table walk for binding, xe_pt_stage_bind() explicitly skips initializing the xe_res_cursor for purged BOs, treating them similarly to NULL VMAs by only setting the cursor size. However, xe_pt_hugepte_possible() and xe_pt_scan_64K() did not check if the BO was purged before attempting to walk the cursor using xe_res_dma() and xe_res_next(). Because the cursor was left uninitialized for purged BOs, this falls through and triggers warnings like: WARNING: drivers/gpu/drm/xe/xe_res_cursor.h:274 at xe_res_next Fix this by explicitly checking if the BO is purged in both xe_pt_hugepte_possible() and xe_pt_scan_64K(), returning early just as we do for NULL VMAs, avoiding the invalid cursor accesses entirely. As a precaution, also zero-initialize the cursor in xe_pt_stage_bind() to ensure we don't pass garbage data into the page table walkers if we ever hit a similar edge case in the future. (cherry picked from commit 4c7b9c6ece32440e5a435a92076d049450cd2d2e)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72358

EUVD

EUVD-2026-59257

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability in the drm/xe driver where purged buffer objects (BOs) are not properly handled during page table binding. The cursor used for walking page tables is left uninitialized for purged BOs, leading to potential invalid memory access and warnings.

Detection Guidance

This vulnerability is specific to the Linux kernel's DRM/XE driver and involves invalid cursor access for purged buffer objects. Detection requires kernel-level inspection rather than network scanning. Check kernel logs for warnings like 'WARNING: drivers/gpu/drm/xe/xe_res_cursor.h:274 at xe_res_next' which indicate the issue. Use commands like 'dmesg | grep xe_res_cursor' or 'journalctl -k | grep xe_res_cursor' to search for these warnings in system logs.

Impact Analysis

This vulnerability could cause system instability or crashes in systems using the Linux kernel with the drm/xe driver. It may lead to kernel warnings or errors during graphics operations involving purged buffer objects.

Compliance Impact

This vulnerability is specific to the Linux kernel's graphics driver (drm/xe) and involves invalid memory access during GPU memory management. It does not directly impact data privacy or security controls required by standards like GDPR or HIPAA, as it relates to system stability rather than data handling or access control.

Mitigation Strategies

Apply the kernel patch that fixes this issue by checking if buffer objects are purged before accessing cursors in xe_pt_hugepte_possible() and xe_pt_scan_64K(). Update to a kernel version containing the fix (commit 4c7b9c6ece32440e5a435a92076d049450cd2d2e). If immediate patching is not possible, consider disabling the affected DRM/XE driver functionality as a temporary workaround.

Hi! I’m here to help you understand CVE-2026-72358. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70