---
id: "CVE-2026-99209"
kind: "vulnerability"
aliases: ["CVE-2026-99209"]
title: "Linux kernel: Xe GPU driver null dereference during dma-buf eviction"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["gpu", "intel-xe", "linux-kernel", "runtime", "self-hosted"]
not_affected_if: ["xe-driver-not-loaded"]
published_at: "2026-10-28T11:17:42+00:00"
first_seen_at: "2026-10-28T11:32:37+00:00"
updated_at: "2026-10-28T11:33:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99209", "first_seen_at": "2026-10-28T11:32:37+00:00"}]
---

# Linux kernel: Xe GPU driver null dereference during dma-buf eviction

In the Linux kernel's Xe GPU driver, an imported dma-buf buffer object whose memory resource was freed can reach the eviction path, where the driver dereferences a null pointer and faults. The sources describe a kernel crash (denial of service); they do not describe code execution or data access.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `uname -r` and check whether the kernel includes the Xe driver fix (commit dbcfaac6331f1fcb0c2fe3ad3e9adb1e5d43ec0c or a stable release carrying it)
- Check whether the Xe driver is loaded with `lsmod | grep xe`; unknown whether other conditions are required

## Fix

- Update the Linux kernel to a stable release that includes commit dbcfaac6331f1fcb0c2fe3ad3e9adb1e5d43ec0c (exact fixed version unknown from the sources)

## Timeline

- 2026-10-28T11:32:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99209

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

drm/xe: skip eviction of a BO with no resource

xe_evict_flags() switches on tbo->resource->mem_type to choose an
eviction placement. An xe BO can reach eviction with no ttm.resource,
e.g. an imported dma-buf BO whose resource was freed during teardown
while its attachment is still live: the exporter then invalidates it via
xe_dma_buf_move_notify() -> xe_bo_evict(), and the switch dereferences a
NULL resource and faults.

A BO with no resource has nothing placed or mapped, so there is nothing
to evict. Return an empty placement (num_placement = 0), mirroring the
handling already used for non-xe scatter-gather BOs just above;
ttm_bo_validate() then takes the pipeline-gutting path and returns 0.

Without the fix the xe_dma_buf@xe_test_dmabuf_move_notify_no_resource
dynamic live selftest will fail with below stack.

BUG: kernel NULL pointer dereference, address: 0000000000000010
RIP: 0010:xe_evict_flags+0xf4/0x140 [xe]
Call Trace:
 <TASK>
 xe_bo_evict+0x40/0xa0 [xe]
 ? ttm_bo_pipeline_gutting+0x71/0x180 [ttm]
 xe_test_dmabuf_move_notify_no_resource+0x182/0x440 [xe]
 xe_dma_buf_kunit+0x387/0x580 [xe]

v2: Add Fixes tag and failure info in commit text (Matt Brost)

(cherry picked from commit dbcfaac6331f1fcb0c2fe3ad3e9adb1e5d43ec0c)

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_