Description
In the Linux kernel, the following vulnerability has been resolved:

drm/xe: fix NPD in bo_meminfo()

When a buffer object is purged, its ttm.resource is set to NULL via the
TTM pipeline gutting flow. However, the BO remains in the client's
object list until userspace explicitly closes the GEM handle. If memory
stats are queried during this time, accessing bo->ttm.resource->mem_type
will result in a NULL pointer dereference.

Fix this by safely skipping purged BOs in bo_meminfo, as they no longer
consume any memory.

User is getting NPD on device resume, and possible theory is that in
bo_move(), if we need to evict something to SYSTEM to save the CCS state,
but the BO is marked as dontneed, this won't trigger a move but will
nuke the pages, leaving us with a NULL bo resource. And the meminfo()
doesn't look ready to handle a NULL resource.

v2 (Sashiko):
- There could potentially be other cases where we might end up with a
NULL resource, so make this a general NULL check for now.

(cherry picked from commit c9a8e7daa0afe3161111e27fd92176e608c7f186)
Published: 2026-08-15
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Linux kernel DRM/xe driver can dereference a NULL pointer when memory statistics are requested for a purged buffer object that has not yet been closed by userspace. The flaw occurs in bo_meminfo() because a purged BO still remains in the client list and its ttm.resource is set to NULL. Querying the buffer’s memory type then triggers a NULL pointer dereference, causing a kernel panic and a system‑wide denial of service. The vulnerability is rooted in CWE‑476 and CWE‑416.

Affected Systems

Every Linux kernel containing the DRM/xe graphics driver before the inclusion of commit c9a8e7daa0afe3161111e27fd92176e608c7f186 is impacted. This includes all distributions and releases based on kernels lacking that patch. Specific version numbers are not listed, but the fix is present in any kernel released after the commit referenced in the advisory.

Risk and Exploitability

The CVSS score for this vulnerability is 5.5. The EPSS score is <1%, and KEV is not listed. The failure mode is a kernel crash that can be triggered by querying GPU memory statistics on a purged buffer while the driver is loaded. Based on the description, it is inferred that the exploit would require a process capable of invoking bo_meminfo()—likely a privileged user—and that this could most readily happen during device resume or when system tools query memory usage. Because a kernel-level crash constitutes a high‑impact denial of service, the risk level for systems running an unpatched kernel is considered high.

Generated by OpenCVE AI on August 22, 2026 at 05:59 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Linux kernel to a version that includes commit c9a8e7daa0afe3161111e27fd92176e608c7f186, which removes the null pointer dereference in bo_meminfo()
  • Reboot the system after the kernel upgrade so the patched GPU driver is loaded
  • If a kernel upgrade cannot be performed immediately, avoid querying GPU memory statistics while buffer objects may be purged, such as during device resume, until the fix is applied

Generated by OpenCVE AI on August 22, 2026 at 05:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 19 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Sat, 15 Aug 2026 19:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416
CWE-476

Sat, 15 Aug 2026 06:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: drm/xe: fix NPD in bo_meminfo() When a buffer object is purged, its ttm.resource is set to NULL via the TTM pipeline gutting flow. However, the BO remains in the client's object list until userspace explicitly closes the GEM handle. If memory stats are queried during this time, accessing bo->ttm.resource->mem_type will result in a NULL pointer dereference. Fix this by safely skipping purged BOs in bo_meminfo, as they no longer consume any memory. User is getting NPD on device resume, and possible theory is that in bo_move(), if we need to evict something to SYSTEM to save the CCS state, but the BO is marked as dontneed, this won't trigger a move but will nuke the pages, leaving us with a NULL bo resource. And the meminfo() doesn't look ready to handle a NULL resource. v2 (Sashiko): - There could potentially be other cases where we might end up with a NULL resource, so make this a general NULL check for now. (cherry picked from commit c9a8e7daa0afe3161111e27fd92176e608c7f186)
Title drm/xe: fix NPD in bo_meminfo()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-17T05:13:09.946Z

Reserved: 2026-08-09T03:40:39.921Z

Link: CVE-2026-72359

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-15T06:22:09.337

Modified: 2026-08-17T06:18:40.113

Link: CVE-2026-72359

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-72359 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-22T06:00:11Z

Weaknesses