---
id: "CVE-2026-98510"
kind: "vulnerability"
aliases: ["CVE-2026-98510"]
title: "Linux kernel Xe driver: NULL pointer dereference when closing a VM"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["gpu-workstations", "intel-xe", "linux-kernel", "runtime"]
not_affected_if: ["no-xe-driver", "non-intel-gpu"]
published_at: "2026-10-18T16:17:02+00:00"
first_seen_at: "2026-10-23T21:57:15+00:00"
updated_at: "2026-10-25T05:25:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98510", "first_seen_at": "2026-10-23T21:57:15+00:00"}]
---

# Linux kernel Xe driver: NULL pointer dereference when closing a VM

In the Linux kernel's Intel Xe DRM driver, a VM's page table root can be freed while shared buffer objects still reference its mappings, so a concurrent buffer eviction can dereference a NULL pointer. The sources describe a kernel crash (denial of service) and do not describe code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the running kernel version with `uname -r` and compare it against the fixed stable branch listed in the upstream commit c2863648959489767f08892fd6e90577d2ea0b6a.
- Confirm the Xe driver is in use with `lsmod | grep xe`.

## Fix

- Update to a kernel release that includes upstream commit c2863648959489767f08892fd6e90577d2ea0b6a (drm/xe/vm: nuke PTs only after unlinking contested VMAs).
- Unknown fixed version numbers; the sources do not list them.

## Timeline

- 2026-10-23T21:57:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98510

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/vm: nuke PTs only after unlinking contested VMAs

In xe_vm_close_and_put(), external-BO VMAs are queued on the contested
list for deferred destruction via xe_vma_destroy_unlocked(). However,
xe_vm_pt_destroy() was previously invoked before processing contested
VMAs, destroying vm->pt_root while those VMAs were still linked to their
respective buffer objects (vm_bo->list.gpuva).

If a concurrent thread evicts one of those shared buffer objects,
xe_bo_trigger_rebind() holding only bo->resv walks the BO's VMAs and, in
fault mode, calls xe_vm_invalidate_vma() -> xe_pt_zap_ptes(). Because
vm->pt_root[tile->id] is already NULL, dereferencing pt->level causes a
NULL ptr deref.

Fix this by deferring xe_vm_free_scratch() and xe_vm_pt_destroy() until
after all contested VMAs have been unlinked and destroyed.

User is reporting hitting a NULL ptr deref in xe_pt_zap_ptes(), which
could be explained by this race.

(cherry picked from commit c2863648959489767f08892fd6e90577d2ea0b6a)

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_