Linux kernel drm/xe VF: NULL dereference detaching CCS buffers after the device is unbound
Impact
In the Xe SR-IOV virtual-function path, CCS read/write buffers are freed during BO destruction, which can run after the device has been unbound while the DRM structure is still valid. xe_sriov_vf_ccs_rw_update_bb_addr() then dereferences device resources that are gone, producing a kernel NULL pointer oops - the reported trace comes from a process simply exiting with a mapped BO. On a virtualised GPU host this is a crash of the guest or host kernel at teardown, not a data-disclosure bug; the operator cost is an unplanned node outage rather than a tenancy break.
Who can reach it
Local, on a node running the Xe driver in SR-IOV VF mode. Requires the device-unbind window, so in practice an administrative action rather than something an unprivileged tenant drives at will.
What to do
Apply the stable fix adding drm_dev guards and reboot the node. Until patched, avoid unbinding or hot-removing the Xe device while GPU workloads hold mapped buffers.
References
Related entries
- Linux kernel drm/xe GuC: async exec queue destruction can deadlock drmm cleanup on device removalCVE-2026-68382 · Linux kernel drm/xe GuC exec queue teardown (device reference lifetime)High
- Linux kernel drm/xe GuC: scheduler keeps a pointer to the exec queue name freed with the queueCVE-2026-68383 · Linux kernel drm/xe GuC submission (scheduler timeline name)High
- Linux kernel drm/xe VF: CCS batch buffers attached/detached without waiting for in-flight BO copyCVE-2026-68384 · Linux kernel drm/xe SR-IOV VF (CCS metadata batch buffers on BO move)High
- Linux kernel vmwgfx: surface array_size taken from userspace without a shader-model boundCVE-2026-68446 · Linux kernel drm/vmwgfx (vmw_surface_metadata::array_size validation)High
- Linux kernel dma-fence: zero-count dedup returns 1, letting amdgpu user-queue waits read an uninitialized fenceCVE-2026-72095 · Linux kernel dma-fence (dma_fence_dedup_array zero-count handling, amdgpu user queues)High
- NVIDIA/Mellanox ConnectX driver (mlx5_ib user access region index release): The driver released the software-side UARCVE-2026-74296 · NVIDIA/Mellanox ConnectX driver (mlx5_ib user access region index release)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.