Linux kernel drm/xe: NULL pointer dereference in VM close race
Summary
The Intel Xe DRM driver in the Linux kernel can crash through a NULL pointer dereference in xe_pt_zap_ptes(). The page tables of a GPU virtual machine were destroyed before contested VMAs were unlinked from shared buffer objects, so a concurrent buffer object eviction could access them. An attacker with local access and a suitable GPU workload could trigger a denial of service; code execution is not demonstrated.
Affected
- Linux kernel, drm/xe driver (Intel Xe graphics), introduced in 6.8, 6.13 and 6.19 branches (per OSV)
- Affected range per the kernel CNA record: from commit b06d47be7c83 up to the stable fixes listed below
- Unknown: exact affected versions per distribution; the third-party VulDB reading is not confirmed
Fixed in
- Linux 6.12.112 and later in the 6.12 series (per OSV and CNA record)
- Linux 6.18.55 and later in the 6.18 series (per OSV and CNA record)
- Linux 7.2.9 and later in the 7.2 series (per OSV and CNA record)
- Unknown: fixed package versions for Ubuntu 24.04 LTS and other distributions
Workaround
- Unknown. No specific workaround is documented.
- Systems without an Intel Xe GPU are not affected; confirm with lspci and the loaded xe module.
Exploitation
- No known exploitation in the wild.
- No CISA KEV entry and no public proof of concept found.
- The issue is a kernel crash caused by a race condition, not a demonstrated code-execution path.
Our recommendation
- Install the distribution kernel update containing the fix as soon as it is available in your patch cycle.
- Prioritise workstations and multi-user or GPU-processing servers with Intel Arc or other Xe-based graphics.
- Check the presence of Intel Xe hardware with lspci and the xe module.
- Monitor the NVD entry and CISA KEV for scoring or exploitation updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Linux kernel stable commit 24a22fb3c731 git.kernel.org
- Linux kernel stable commit 70fddc065ac8 git.kernel.org
- Linux kernel stable commit ba678c2b02e0 git.kernel.org
- Linux kernel stable commit bddaa5e4094c git.kernel.org
- OSV entry CVE-2026-98510 osv.dev
- Ubuntu security tracker CVE-2026-98510 ubuntu.com
- VulDB CVE-2026-98510 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 23:42.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: nuke PTs only after unlinking contested VMAs In xe_vm_close_and_put(), external-BO VMAs are queued on the contested list for deferred destruction via xe_vma_destroy_unlocked(). However, xe_vm_pt_destroy() was previously invoked before processing contested VMAs, destroying vm->pt_root while those VMAs were still linked to their respective buffer objects (vm_bo->list.gpuva). If a concurrent thread evicts one of those shared buffer objects, xe_bo_trigger_rebind() holding only bo->resv walks the BO's VMAs and, in fault mode, calls xe_vm_invalidate_vma() -> xe_pt_zap_ptes(). Because vm->pt_root[tile->id] is already NULL, dereferencing pt->level causes a NULL ptr deref. Fix this by deferring xe_vm_free_scratch() and xe_vm_pt_destroy() until after all contested VMAs have been unlinked and destroyed. User is reporting hitting a NULL ptr deref in xe_pt_zap_ptes(), which could be explained by this race. (cherry picked from commit c2863648959489767f08892fd6e90577d2ea0b6a)
NVD references (4)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.