Cloudanix VulnDB

CVE-2026-99209

None

CVSS

—

EPSS

0.2%

Published

Oct 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the operating system's graphics handling can cause the computer to crash unexpectedly during certain memory operations.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Null pointer dereference in the graphics driver's eviction function when a buffer object has no associated resource, triggered during dma-buf teardown scenarios.

Why it matters to the business

Kernel crashes or system instability on systems using the affected graphics driver, leading to downtime and potential loss of unsaved work.

How an attack unfolds

An attacker or local process triggers buffer eviction paths involving imported dma-buf objects during teardown, causing the kernel to follow a null resource pointer and fault.

How to fix it

Apply the upstream kernel patch that returns an empty placement for buffer objects without resources, preventing the null dereference in xe_evict_flags.

How to confirm the fix worked

Confirm the patch is present by inspecting xe_evict_flags for the num_placement=0 handling and re-run relevant dma-buf selftests to ensure no NULL dereference occurs.

Typical attack path

  1. Create or import a dma-buf buffer object
  2. Initiate teardown that frees the underlying resource while attachment remains live
  3. Trigger eviction via move notification
  4. Execute the switch on null resource causing dereference

How to detect it

Inspect kernel logs and oops reports for stack traces containing xe_evict_flags, xe_bo_evict, or xe_dma_buf_move_notify during dma-buf operations.

  • xe_evict_flags+0xf4/0x140
  • BUG: kernel NULL pointer dereference
  • xe_test_dmabuf_move_notify_no_resource

What your security team should do

  • Prioritize kernel updates containing the fix once available due to recent publication
  • Monitor kernel logs for xe module NULL pointer dereferences
  • Restrict untrusted local code execution on affected systems until patched

The record

In the Linux kernel, the following vulnerability has been resolved: drm/xe: skip eviction of a BO with no resource xe_evict_flags() switches on tbo->resource->mem_type to choose an eviction placement. An xe BO can reach eviction with no ttm.resource, e.g. an imported dma-buf BO whose resource was freed during teardown while its attachment is still live: the exporter then invalidates it via xe_dma_buf_move_notify() -> xe_bo_evict(), and the switch dereferences a NULL resource and faults. A BO with no resource has nothing placed or mapped, so there is nothing to evict. Return an empty placement (num_placement = 0), mirroring the handling already used for non-xe scatter-gather BOs just above; ttm_bo_validate() then takes the pipeline-gutting path and returns 0. Without the fix the xe_dma_buf@xe_test_dmabuf_move_notify_no_resource dynamic live selftest will fail with below stack. BUG: kernel NULL pointer dereference, address: 0000000000000010 RIP: 0010:xe_evict_flags+0xf4/0x140 [xe] Call Trace: <TASK> xe_bo_evict+0x40/0xa0 [xe] ? ttm_bo_pipeline_gutting+0x71/0x180 [ttm] xe_test_dmabuf_move_notify_no_resource+0x182/0x440 [xe] xe_dma_buf_kunit+0x387/0x580 [xe] v2: Add Fixes tag and failure info in commit text (Matt Brost) (cherry picked from commit dbcfaac6331f1fcb0c2fe3ad3e9adb1e5d43ec0c)

Affected packages

Ecosystem Package Introduced Fixed