Live › vulnerability › CVE-2026-99209
Go to dashboardIn the Linux kernel's Xe GPU driver, an imported dma-buf buffer object whose memory resource was freed can reach the eviction path, where the driver dereferences a null pointer and faults. The sources describe a kernel crash (denial of service); they do not describe code execution or data access.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 11:32 UTC. All times on this page are UTC.
Systems running a Linux kernel with the Xe DRM driver (Intel Xe GPUs) that use dma-buf buffer sharing with imported buffers. The sources do not state a specific trigger workload. Systems without Intel Xe GPUs or without the Xe driver loaded are likely unaffected, but the sources do not confirm this.
No product ranges from the sources yet.
uname -r and check whether the kernel includes the Xe driver fix (commit dbcfaac6331f1fcb0c2fe3ad3e9adb1e5d43ec0c or a stable release carrying it)lsmod | grep xe; unknown whether other conditions are requiredEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
drm/xe: skip eviction of a BO with no resource
xe_evict_flags() switches on tbo->resource->mem_type to choose an eviction placement. An xe BO can reach eviction with no ttm.resource, e.g. an imported dma-buf BO whose resource was freed during teardown while its attachment is still live: the exporter then invalidates it via xe_dma_buf_move_notify() -> xe_bo_evict(), and the switch dereferences a NULL resource and faults.
A BO with no resource has nothing placed or mapped, so there is nothing to evict. Return an empty placement (num_placement = 0), mirroring the handling already used for non-xe scatter-gather BOs just above; ttm_bo_validate() then takes the pipeline-gutting path and returns 0.
Without the fix the xe_dma_buf@xe_test_dmabuf_move_notify_no_resource dynamic live selftest will fail with below stack.
BUG: kernel NULL pointer dereference, address: 0000000000000010 RIP: 0010:xe_evict_flags+0xf4/0x140 [xe] Call Trace: <TASK> xe_bo_evict+0x40/0xa0 [xe] ? ttm_bo_pipeline_gutting+0x71/0x180 [ttm] xe_test_dmabuf_move_notify_no_resource+0x182/0x440 [xe] xe_dma_buf_kunit+0x387/0x580 [xe]
v2: Add Fixes tag and failure info in commit text (Matt Brost)
(cherry picked from commit dbcfaac6331f1fcb0c2fe3ad3e9adb1e5d43ec0c)
This page as .md · .json · in your agent: get_signal("CVE-2026-99209")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.