Linux kernel drm/xe: NULL pointer dereference racing VM close against eviction of a shared BO
Impact
xe_vm_close_and_put() destroyed vm->pt_root before unlinking VMAs that were still attached to external buffer objects. If another thread evicts one of those shared BOs, xe_bo_trigger_rebind() reaches xe_pt_zap_ptes() with a NULL pt_root and the kernel dereferences it, panicking the node. On an Intel accelerator node this is a crash of the whole host, not just the offending process - every co-resident job dies and the node needs an unplanned reboot rather than a drain. A user is reported hitting this NULL deref in the field, though as a race rather than a deliberate exploit; the record shows no privilege-escalation path.
Who can reach it
Local user with access to the xe DRM device who can create and tear down VMs while shared buffer objects are under memory pressure - any tenant with a GPU pod on an Intel GPU node. Race-dependent, so not reliably triggerable.
What to do
Move to a stable kernel containing the fix for your series (four stable commits listed) and reboot each affected node. Only nodes running Intel GPUs under the xe driver are affected; nothing to do on NVIDIA or AMD fleets. No vendor advisory or fixed distro version appears in the record.
References
Related entries
- Linux kernel nouveau: double-free of VMM page array when client init fails on device openCVE-2026-98515 · Linux kernel nouveau (nvif_vmm_dtor client teardown)High
- Linux kernel nouveau/uvmm: use-after-free reading resource type when BO sits in TTM_PL_SYSTEMCVE-2026-98517 · Linux kernel nouveau uvmm (GPU VA bind path, TTM_PL_SYSTEM resource)High
- Linux kernel amdkfd: cached address_space for /dev/kfd causes use-after-free and missed unmap on GPU resetCVE-2026-98520 · Linux kernel amdgpu/amdkfd (kfd_dev_mapping cached address_space)High
- Linux kernel drm/xe: final framebuffer unpin leaves a stale pinned-list entry and risks use-after-freeCVE-2026-98999 · Linux kernel drm/xe (pinned_link bookkeeping on framebuffer unpin)High
- Linux drm/i915: execbuffer relocation cleanup frees past the exec array after command-parser VMAsCVE-2026-99006 · Linux kernel drm/i915 GEM execbuffer (relocation cleanup past the exec array)High
- NVIDIA GPU Display Driver - kernel mode layer (Windows nvlddmkm.sys and Linux nvidia.ko): An out-of-bounds readCVE-2022-28183 · NVIDIA GPU Display Driver - kernel mode layer (Windows nvlddmkm.sys and Linux nvidia.ko)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.