{"id":"CVE-2026-98510","kind":"vulnerability","aliases":["CVE-2026-98510"],"related":[],"title":"Linux kernel Xe driver: NULL pointer dereference when closing a VM","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/vm: nuke PTs only after unlinking contested VMAs\n\nIn xe_vm_close_and_put(), external-BO VMAs are queued on the contested\nlist for deferred destruction via xe_vma_destroy_unlocked(). However,\nxe_vm_pt_destroy() was previously invoked before processing contested\nVMAs, destroying vm->pt_root while those VMAs were still linked to their\nrespective buffer objects (vm_bo->list.gpuva).\n\nIf a concurrent thread evicts one of those shared buffer objects,\nxe_bo_trigger_rebind() holding only bo->resv walks the BO's VMAs and, in\nfault mode, calls xe_vm_invalidate_vma() -> xe_pt_zap_ptes(). Because\nvm->pt_root[tile->id] is already NULL, dereferencing pt->level causes a\nNULL ptr deref.\n\nFix this by deferring xe_vm_free_scratch() and xe_vm_pt_destroy() until\nafter all contested VMAs have been unlinked and destroyed.\n\nUser is reporting hitting a NULL ptr deref in xe_pt_zap_ptes(), which\ncould be explained by this race.\n\n(cherry picked from commit c2863648959489767f08892fd6e90577d2ea0b6a)","summary":"In the Linux kernel's Intel Xe DRM driver, a VM's page table root can be freed while shared buffer objects still reference its mappings, so a concurrent buffer eviction can dereference a NULL pointer. The sources describe a kernel crash (denial of service) and do not describe code execution.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gpu-workstations","intel-xe","linux-kernel","runtime"],"not_affected_if":["no-xe-driver","non-intel-gpu"],"how_to_check":"- Check the running kernel version with `uname -r` and compare it against the fixed stable branch listed in the upstream commit c2863648959489767f08892fd6e90577d2ea0b6a.\n- Confirm the Xe driver is in use with `lsmod | grep xe`.","fix":"- Update to a kernel release that includes upstream commit c2863648959489767f08892fd6e90577d2ea0b6a (drm/xe/vm: nuke PTs only after unlinking contested VMAs).\n- Unknown fixed version numbers; the sources do not list them.","status":"open","published_at":"2026-10-18T16:17:02+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:25:23+00:00","updated_at":"2026-10-25T05:25:23+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T05:25:23Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a kernel release that includes upstream commit c2863648959489767f08892fd6e90577d2ea0b6a (drm/xe/vm: nuke PTs only after unlinking contested VMAs).\n- Unknown fixed version numbers; the sources do not list them.","reach":"local","title":"Linux kernel Xe driver: NULL pointer dereference when closing a VM","impact":"low","summary":"In the Linux kernel's Intel Xe DRM driver, a VM's page table root can be freed while shared buffer objects still reference its mappings, so a concurrent buffer eviction can dereference a NULL pointer. The sources describe a kernel crash (denial of service) and do not describe code execution.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","intel-xe","gpu-workstations"],"confidence":0.6,"needs_auth":"unknown","worst_case":"kernel NULL pointer dereference causes a crash or denial of service","analyst_note":"Confirm the affected and fixed kernel version ranges from the stable kernel commit and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-98510.","how_to_check":"- Check the running kernel version with `uname -r` and compare it against the fixed stable branch listed in the upstream commit c2863648959489767f08892fd6e90577d2ea0b6a.\n- Confirm the Xe driver is in use with `lsmod | grep xe`.","needs_analyst":true,"not_affected_if":["no-xe-driver","non-intel-gpu"],"who_is_affected":"Systems running a Linux kernel with the Intel Xe DRM driver loaded, typically machines with recent Intel Arc or Xe-architecture graphics. The race needs a shared buffer object being evicted while a VM is closed, which is more likely under GPU workloads. Systems without the Xe driver, such as those using only the i915 driver or no Intel GPU, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000728,"input_tokens":3675,"output_tokens":720,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98510':14A,17A 'alreadi':195C 'bo':105C,149C,163C,168C,172C 'buffer':48B,57B,146C,160C 'c2863648959489767f08892fd6e90577d2ea0b6a':252C 'call':179C 'caus':200C 'cherri':248C 'close':9A,100C 'code':77B 'commit':251C 'concurr':56B,153C 'contest':95C,111C,131C,221C 'could':242C 'crash':69B 'cve':12A,15A 'defer':114C,208C 'denial':70B 'deref':204C,235C 'derefer':7A,60B 'dereferenc':197C 'describ':66B,76B 'destroy':119C,125C,133C,217C,227C 'destruct':115C 'driver':4A,36B 'drm':35B 'drm/xe/vm':89C 'evict':58B,155C 'execut':78B 'explain':244C 'extern':104C 'external-bo':103C 'fault':177C 'fix':205C 'follow':84C 'free':211C 'freed':45B 'gpu':19B 'gpu-workst':18B 'hit':231C 'hold':166C 'howev':121C 'id':193C 'intel':22B,33B 'intel-x':21B 'invalid':182C 'invok':128C 'kernel':2A,26B,31B,68B,82C 'level':199C 'link':142C 'linux':1A,25B,30B,81C 'linux-kernel':24B 'list':112C 'list.gpuva':150C 'map':53B 'mode':178C 'nuke':90C 'null':5A,62B,196C,202C,233C 'object':49B,147C,161C 'one':156C 'page':40B 'pick':249C 'pointer':6A,63B 'previous':127C 'process':130C 'pt':124C,135C,185C,190C,198C,216C,238C 'ptes':187C,240C 'ptr':203C,234C 'pts':91C 'put':102C 'queu':108C 'race':247C 'rebind':165C 'refer':51B 'report':230C 'resolv':88C 'respect':145C 'resv':169C 'root':42B,136C,191C 'runtim':27B 'scratch':212C 'servic':72B 'share':47B,159C 'sourc':65B 'still':50B,141C 'tabl':41B 'thread':154C 'tile':192C 'trigger':164C 'unlink':94C,225C 'unlock':120C 'user':228C 'via':116C 'vm':11A,38B,99C,123C,134C,148C,181C,189C,210C,215C 'vma':118C,183C 'vmas':96C,106C,132C,139C,174C,222C 'vulner':85C 'walk':170C 'workstat':20B 'xe':3A,23B,34B,98C,117C,122C,162C,180C,184C,209C,214C,237C 'zap':186C,239C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the Intel Xe DRM driver loaded, typically machines with recent Intel Arc or Xe-architecture graphics. The race needs a shared buffer object being evicted while a VM is closed, which is more likely under GPU workloads. Systems without the Xe driver, such as those using only the i915 driver or no Intel GPU, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:02+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98510","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98510","severity":null,"published_at":"2026-10-18T16:17:02+00:00","modified_at":"2026-10-19T10:19:04+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}