CVE-2026-72362 - Vulnerability Details

- drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry()

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry()

The page-table walk framework may pass a NULL *child pointer for
unpopulated entries. xe_pt_zap_ptes_entry() called container_of(*child)
before checking for NULL, then dereferenced the result, causing a crash.

Move the container_of() call after a NULL guard, so the function returns
early instead of proceeding with an invalid pointer. XE_WARN_ON is kept
to help root cause the issue, but we now bail instead of crashing the
driver.

v2: Comment that triggering XE_WARN_ON is unexpected behavior (Matt Brost)

(cherry picked from commit b9297d19d9df5d4b6c994648570c5dcd1cac68ff)

Published: 2026-08-15

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The issue is a NULL pointer dereference within the DRM Xe page‑table walk. The function xe_pt_zap_ptes_entry() called container_of() on a NULL child pointer before verifying it, causing the kernel to crash. This produces a system‑wide denial of service. The flaw is a classic unsafe pointer use, classified as CWE‑476.

Affected Systems

All Linux kernels that have not incorporated the safety check commit (b9297d19d9df5d4b6c994648570c5dcd1cac68ff). No distribution or version numbers are defined in the advisory; any kernel prior to this commit could be vulnerable.

Risk and Exploitability

The EPSS score is less than 1% and the flaw is not listed in the CISA KEV catalog, indicating no publicly known exploitation. However, the bug can be triggered locally by a user with sufficient privileges to access the DRM Xe driver, making it a high‑risk local denial of service. The CVSS score of 5.5 indicates moderate severity; the low exploitation probability confirmed by the EPSS score suggests a low likelihood of exploitation, but the vulnerability remains a serious local denial of service if triggered by an attacker with sufficient privileges.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`dd08ebf6c3525a7ea2186e636df064ea47281987`	affected	< ff330ce16c846b70164ff0eb544c81219d4c5c08
`dd08ebf6c3525a7ea2186e636df064ea47281987`	affected	< 78b1074966d290d4517f42bc81e13c4349368d12
`dd08ebf6c3525a7ea2186e636df064ea47281987`	affected	< d94b9922b2ae5ee6e900f8da0bd537b251c6110c
`dd08ebf6c3525a7ea2186e636df064ea47281987`	affected	< 3feeb667197bd58a17f4edfdbcad249ffcb3c864

Linux

affected

Version	Status	Constraints
`6.8`	affected	—
`0`	unaffected	< 6.8
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[dd08ebf6c3525a7ea2186e636df064ea47281987,ff330ce16c846b70164ff0eb544c81219d4c5c08)`	affected	code_commit	—
`[dd08ebf6c3525a7ea2186e636df064ea47281987,78b1074966d290d4517f42bc81e13c4349368d12)`	affected	code_commit	—
`[dd08ebf6c3525a7ea2186e636df064ea47281987,d94b9922b2ae5ee6e900f8da0bd537b251c6110c)`	affected	code_commit	—
`[dd08ebf6c3525a7ea2186e636df064ea47281987,3feeb667197bd58a17f4edfdbcad249ffcb3c864)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.8`	affected	generic	—
`[0,6.8)`	unaffected	semver	—
`[6.12.97,6.13.0)`	unaffected	generic	—
`[6.18.40,6.19.0)`	unaffected	generic	—
`[7.1.5,7.2.0)`	unaffected	generic	—
`[7.2-rc2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the commit adding the NULL guard (b9297d19d9df5d4b6c994648570c5dcd1cac68ff).
If an immediate kernel upgrade is not possible, unload or disable the Xe driver module (e.g., modprobe -r i915) to prevent the crash and plan to update once the patch is available.
Restrict access to DRM device nodes by ensuring they are owned by root and group video with mode 0660, and consider applying SELinux or AppArmor rules that limit write access to privileged users only, thereby reducing the attack surface for local exploitation.

Generated by OpenCVE AI on August 22, 2026 at 05:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.002.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/3feeb667197bd58a17f4edfdbcad249ffcb3c864
https://git.kernel.org/stable/c/78b1074966d290d4517f42bc81e13c4349368d12
https://git.kernel.org/stable/c/d94b9922b2ae5ee6e900f8da0bd537b251c6110c
https://git.kernel.org/stable/c/ff330ce16c846b70164ff0eb544c81219d4c5c08
https://lore.kernel.org/linux-cve-announce/2026081514-CVE-2026-72362-db77@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-72362
https://www.cve.org/CVERecord?id=CVE-2026-72362

History

Thu, 20 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026081514-CVE-2026-72362-db77@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-72362 https://www.cve.org/CVERecord?id=CVE-2026-72362
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sat, 15 Aug 2026 19:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Sat, 15 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry() The page-table walk framework may pass a NULL child pointer for unpopulated entries. xe_pt_zap_ptes_entry() called container_of(child) before checking for NULL, then dereferenced the result, causing a crash. Move the container_of() call after a NULL guard, so the function returns early instead of proceeding with an invalid pointer. XE_WARN_ON is kept to help root cause the issue, but we now bail instead of crashing the driver. v2: Comment that triggering XE_WARN_ON is unexpected behavior (Matt Brost) (cherry picked from commit b9297d19d9df5d4b6c994648570c5dcd1cac68ff)
Title		drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/3feeb667197bd58a17f4edfdbcad249ffcb3c864 https://git.kernel.org/stable/c/78b1074966d290d4517f42bc81e13c4349368d12 https://git.kernel.org/stable/c/d94b9922b2ae5ee6e900f8da0bd537b251c6110c https://git.kernel.org/stable/c/ff330ce16c846b70164ff0eb544c81219d4c5c08

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:56:01.414Z

Updated: 2026-08-17T05:13:13.207Z

Reserved: 2026-08-09T03:40:39.921Z

Link: CVE-2026-72362

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:22:09.627

Modified: 2026-08-17T06:18:40.400

Link: CVE-2026-72362

Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-72362 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-22T06:00:11Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object