CVE-2026-72359
Received Received - Intake

NULL Pointer Dereference in Linux Kernel DRM/XE Driver

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: drm/xe: fix NPD in bo_meminfo() When a buffer object is purged, its ttm.resource is set to NULL via the TTM pipeline gutting flow. However, the BO remains in the client's object list until userspace explicitly closes the GEM handle. If memory stats are queried during this time, accessing bo->ttm.resource->mem_type will result in a NULL pointer dereference. Fix this by safely skipping purged BOs in bo_meminfo, as they no longer consume any memory. User is getting NPD on device resume, and possible theory is that in bo_move(), if we need to evict something to SYSTEM to save the CCS state, but the BO is marked as dontneed, this won't trigger a move but will nuke the pages, leaving us with a NULL bo resource. And the meminfo() doesn't look ready to handle a NULL resource. v2 (Sashiko): - There could potentially be other cases where we might end up with a NULL resource, so make this a general NULL check for now. (cherry picked from commit c9a8e7daa0afe3161111e27fd92176e608c7f186)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72359
EUVD
EUVD-2026-59258

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a NULL pointer dereference (NPD) vulnerability in the Linux kernel's drm/xe driver. It occurs when querying memory stats for a buffer object (BO) that has been purged. The BO's resource is set to NULL during purging but remains in the client's object list until the GEM handle is closed. Accessing the NULL resource causes a crash during memory stats queries or device resume.

Detection Guidance

This vulnerability is specific to the Linux kernel's DRM/XE subsystem and may not have direct network detection methods. Check kernel logs for NULL pointer dereference errors related to drm/xe or bo_meminfo. Commands like dmesg | grep -i 'NPD\|NULL pointer\|drm/xe' may help identify issues.

Impact Analysis

This vulnerability can cause system crashes (kernel panic) when memory statistics are queried or during device resume operations. It may lead to denial of service if exploited, as the kernel will dereference a NULL pointer and terminate unexpectedly.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-72359. Monitor kernel logs for related errors and ensure GPU drivers are up to date. If affected, avoid suspend/resume cycles until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72359. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart