{"id":"CVE-2026-99209","kind":"vulnerability","aliases":["CVE-2026-99209"],"related":[],"title":"Linux kernel: Xe GPU driver null dereference during dma-buf eviction","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: skip eviction of a BO with no resource\n\nxe_evict_flags() switches on tbo->resource->mem_type to choose an\neviction placement. An xe BO can reach eviction with no ttm.resource,\ne.g. an imported dma-buf BO whose resource was freed during teardown\nwhile its attachment is still live: the exporter then invalidates it via\nxe_dma_buf_move_notify() -> xe_bo_evict(), and the switch dereferences a\nNULL resource and faults.\n\nA BO with no resource has nothing placed or mapped, so there is nothing\nto evict. Return an empty placement (num_placement = 0), mirroring the\nhandling already used for non-xe scatter-gather BOs just above;\nttm_bo_validate() then takes the pipeline-gutting path and returns 0.\n\nWithout the fix the xe_dma_buf@xe_test_dmabuf_move_notify_no_resource\ndynamic live selftest will fail with below stack.\n\nBUG: kernel NULL pointer dereference, address: 0000000000000010\nRIP: 0010:xe_evict_flags+0xf4/0x140 [xe]\nCall Trace:\n <TASK>\n xe_bo_evict+0x40/0xa0 [xe]\n ? ttm_bo_pipeline_gutting+0x71/0x180 [ttm]\n xe_test_dmabuf_move_notify_no_resource+0x182/0x440 [xe]\n xe_dma_buf_kunit+0x387/0x580 [xe]\n\nv2: Add Fixes tag and failure info in commit text (Matt Brost)\n\n(cherry picked from commit dbcfaac6331f1fcb0c2fe3ad3e9adb1e5d43ec0c)","summary":"In the Linux kernel's Xe GPU driver, an imported dma-buf buffer object whose memory resource was freed can reach the eviction path, where the driver dereferences a null pointer and faults. The sources describe a kernel crash (denial of service); they do not describe code execution or data access.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gpu","intel-xe","linux-kernel","runtime","self-hosted"],"not_affected_if":["xe-driver-not-loaded"],"how_to_check":"- Run `uname -r` and check whether the kernel includes the Xe driver fix (commit dbcfaac6331f1fcb0c2fe3ad3e9adb1e5d43ec0c or a stable release carrying it)\n- Check whether the Xe driver is loaded with `lsmod | grep xe`; unknown whether other conditions are required","fix":"- Update the Linux kernel to a stable release that includes commit dbcfaac6331f1fcb0c2fe3ad3e9adb1e5d43ec0c (exact fixed version unknown from the sources)","status":"open","published_at":"2026-10-28T11:17:42+00:00","first_seen_at":"2026-10-28T11:32:37+00:00","triaged_at":"2026-10-28T11:33:52+00:00","updated_at":"2026-10-28T11:33:52+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-28T11:33:52Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a stable release that includes commit dbcfaac6331f1fcb0c2fe3ad3e9adb1e5d43ec0c (exact fixed version unknown from the sources)","reach":"local","title":"Linux kernel: Xe GPU driver null dereference during dma-buf eviction","impact":"low","summary":"In the Linux kernel's Xe GPU driver, an imported dma-buf buffer object whose memory resource was freed can reach the eviction path, where the driver dereferences a null pointer and faults. The sources describe a kernel crash (denial of service); they do not describe code execution or data access.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","intel-xe","gpu","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Kernel NULL pointer dereference causes a crash, denial of service","analyst_note":"Check the NVD entry and the upstream stable kernel commit for affected and fixed kernel version ranges and the trigger conditions.","how_to_check":"- Run `uname -r` and check whether the kernel includes the Xe driver fix (commit dbcfaac6331f1fcb0c2fe3ad3e9adb1e5d43ec0c or a stable release carrying it)\n- Check whether the Xe driver is loaded with `lsmod | grep xe`; unknown whether other conditions are required","needs_analyst":true,"not_affected_if":["xe-driver-not-loaded"],"who_is_affected":"Systems running a Linux kernel with the Xe DRM driver (Intel Xe GPUs) that use dma-buf buffer sharing with imported buffers. The sources do not state a specific trigger workload. Systems without Intel Xe GPUs or without the Xe driver loaded are likely unaffected, but the sources do not confirm this.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000724,"input_tokens":3825,"output_tokens":684,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':251C,259C,266C,276C,283C '-2026':14A,17A '-99209':15A,18A '0':188C,216C '0000000000000010':245C '0010':247C 'access':81B 'add':287C 'address':244C 'alreadi':192C 'attach':139C 'bo':97C,117C,130C,155C,167C,205C,257C,263C 'bos':201C 'brost':297C 'buf':11A,42B,129C,151C,223C,281C 'buffer':43B 'bug':239C 'call':254C 'cherri':298C 'choos':111C 'code':77B 'commit':294C,301C 'crash':69B 'cve':13A,16A 'data':80B 'dbcfaac6331f1fcb0c2fe3ad3e9adb1e5d43ec0c':302C 'denial':70B 'derefer':7A,58B,160C,243C 'describ':66B,76B 'dma':10A,41B,128C,150C,222C,280C 'dma-buf':9A,40B,127C 'dmabuf':226C,271C 'driver':5A,37B,57B 'drm/xe':92C 'dynam':231C 'e.g':124C 'empti':184C 'evict':12A,53B,94C,102C,113C,120C,156C,181C,249C,258C 'execut':78B 'export':144C 'fail':235C 'failur':291C 'fault':63B,165C 'fix':219C,288C 'flag':103C,250C 'follow':87C 'freed':49B,134C 'gather':200C 'gpu':4A,19B,36B 'gut':212C,265C 'handl':191C 'host':29B 'import':39B,126C 'info':292C 'intel':21B 'intel-x':20B 'invalid':146C 'kernel':2A,25B,33B,68B,85C,240C 'kunit':282C 'linux':1A,24B,32B,84C 'linux-kernel':23B 'live':142C,232C 'map':175C 'matt':296C 'mem':108C 'memori':46B 'mirror':189C 'move':152C,227C,272C 'non':196C 'non-x':195C 'noth':172C,179C 'notifi':153C,228C,273C 'null':6A,60B,162C,241C 'num':186C 'object':44B 'path':54B,213C 'pick':299C 'pipelin':211C,264C 'pipeline-gut':210C 'place':173C 'placement':114C,185C,187C 'pointer':61B,242C 'reach':51B,119C 'resolv':91C 'resourc':47B,100C,107C,132C,163C,170C,230C,275C 'return':182C,215C 'rip':246C 'runtim':26B 'scatter':199C 'scatter-gath':198C 'self':28B 'self-host':27B 'selftest':233C 'servic':72B 'skip':93C 'sourc':65B 'stack':238C 'still':141C 'switch':104C,159C 'tag':289C 'take':208C 'tbo':106C 'teardown':136C 'test':225C,270C 'text':295C 'trace':255C 'ttm':204C,262C,268C 'ttm.resource':123C 'type':109C 'use':193C 'v2':286C 'valid':206C 'via':148C 'vulner':88C 'whose':45B,131C 'without':217C 'x182/0x440':277C 'x387/0x580':284C 'x40/0xa0':260C 'x71/0x180':267C 'xe':3A,22B,35B,101C,116C,149C,154C,197C,221C,224C,248C,253C,256C,261C,269C,278C,279C,285C 'xf4/0x140':252C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the Xe DRM driver (Intel Xe GPUs) that use dma-buf buffer sharing with imported buffers. The sources do not state a specific trigger workload. Systems without Intel Xe GPUs or without the Xe driver loaded are likely unaffected, but the sources do not confirm this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:42+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99209","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99209","severity":null,"published_at":"2026-10-28T11:17:42+00:00","modified_at":"2026-10-28T11:17:42+00:00","first_seen_at":"2026-10-28T11:32:37+00:00","fetched_at":"2026-10-28T11:32:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}