CVE-2026-97519: drm/xe: Fix null pointer dereference in devcoredump cleanup
In the Linux kernel, the following vulnerability has been resolved:
drm/xe: Fix null pointer dereference in devcoredump cleanup
In xedevcoredumpsnapshotfree(), ss->gt may be NULL when the snapshot was never fully populated (e.g., when cleanup is triggered without a prior capture). Guard the xeguccaptureputmatchednodes() call with ISERRORNULL() to prevent a null dereference.
In xedevcoredumpfree(), the deferred work is only queued when a coredump is captured, so guard cancelworksync() with a check on coredump->captured.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Guard the xe_guc_capture_put_matched_nodes() call with IS_ERR_OR_NULL() to prevent a null dereference.
- Compensating control
In xe_devcoredump_snapshot_free(), guard cancel_work_sync() with a check on coredump->captured because ss->gt may be NULL when the snapshot coredump was not fully populated.
Event History
Frequently Asked Questions
What condition triggers the null pointer dereference?
The issue can occur when devcoredump cleanup runs for a snapshot that was never fully populated, leaving ss->gt as NULL. This can happen when cleanup is triggered without a prior capture.
Is deferred-work cleanup always involved?
No. Deferred work is only queued when a coredump has been captured. The fix avoids calling cancel_work_sync() unless coredump->captured is set.
How can I determine whether the relevant fixes are present?
Check whether your kernel includes the stable commits f5c3144f783f91d74b4fae84fb8bd7a4edf001f8 and 12ef528d78adc8ea4e7e3db594f3bcac327e79fa.