Riskcovery

CVE-2026-72362

drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry()

State
Published
Severity
Not scored
Published
Aug 15, 2026
Updated
Aug 17, 2026
Reserved
Aug 9, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry()

The page-table walk framework may pass a NULL *child pointer for unpopulated entries. xe_pt_zap_ptes_entry() called container_of(*child) before checking for NULL, then dereferenced the result, causing a crash.

Move the container_of() call after a NULL guard, so the function returns early instead of proceeding with an invalid pointer. XE_WARN_ON is kept to help root cause the issue, but we now bail instead of crashing the driver.

v2: Comment that triggering XE_WARN_ON is unexpected behavior (Matt Brost)

(cherry picked from commit b9297d19d9df5d4b6c994648570c5dcd1cac68ff)

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • dd08ebf6c3525a7ea2186e636df064ea47281987 to before ff330ce16c846b70164ff0eb544c81219d4c5c08Affected
  • dd08ebf6c3525a7ea2186e636df064ea47281987 to before 78b1074966d290d4517f42bc81e13c4349368d12Affected
  • dd08ebf6c3525a7ea2186e636df064ea47281987 to before d94b9922b2ae5ee6e900f8da0bd537b251c6110cAffected
  • dd08ebf6c3525a7ea2186e636df064ea47281987 to before 3feeb667197bd58a17f4edfdbcad249ffcb3c864Affected
LinuxLinux
  • 6.8Affected
  • before 6.8Not affected
  • 6.12.97 through 6.12.*Not affected
  • 6.18.40 through 6.18.*Not affected
  • 7.1.5 through 7.1.*Not affected
  • 7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.