Live › vulnerability › CVE-2026-98510
Go to dashboardIn the Linux kernel's Intel Xe DRM driver, a VM's page table root can be freed while shared buffer objects still reference its mappings, so a concurrent buffer eviction can dereference a NULL pointer. The sources describe a kernel crash (denial of service) and do not describe code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with the Intel Xe DRM driver loaded, typically machines with recent Intel Arc or Xe-architecture graphics. The race needs a shared buffer object being evicted while a VM is closed, which is more likely under GPU workloads. Systems without the Xe driver, such as those using only the i915 driver or no Intel GPU, can skip it.
No product ranges from the sources yet.
uname -r and compare it against the fixed stable branch listed in the upstream commit c2863648959489767f08892fd6e90577d2ea0b6a.lsmod | grep xe.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
drm/xe/vm: nuke PTs only after unlinking contested VMAs
In xe_vm_close_and_put(), external-BO VMAs are queued on the contested list for deferred destruction via xe_vma_destroy_unlocked(). However, xe_vm_pt_destroy() was previously invoked before processing contested VMAs, destroying vm->pt_root while those VMAs were still linked to their respective buffer objects (vm_bo->list.gpuva).
If a concurrent thread evicts one of those shared buffer objects, xe_bo_trigger_rebind() holding only bo->resv walks the BO's VMAs and, in fault mode, calls xe_vm_invalidate_vma() -> xe_pt_zap_ptes(). Because vm->pt_root[tile->id] is already NULL, dereferencing pt->level causes a NULL ptr deref.
Fix this by deferring xe_vm_free_scratch() and xe_vm_pt_destroy() until after all contested VMAs have been unlinked and destroyed.
User is reporting hitting a NULL ptr deref in xe_pt_zap_ptes(), which could be explained by this race.
(cherry picked from commit c2863648959489767f08892fd6e90577d2ea0b6a)
This page as .md · .json · in your agent: get_signal("CVE-2026-98510")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.