CVE-2026-98510: drm/xe/vm: nuke PTs only after unlinking contested VMAs
In the Linux kernel, the following vulnerability has been resolved:
drm/xe/vm: nuke PTs only after unlinking contested VMAs
In xevmcloseandput(), external-BO VMAs are queued on the contested list for deferred destruction via xevmadestroyunlocked(). However, xevmptdestroy() was previously invoked before processing contested VMAs, destroying vm->ptroot while those VMAs were still linked to their respective buffer objects (vmbo->list.gpuva).
If a concurrent thread evicts one of those shared buffer objects, xebotriggerrebind() holding only bo->resv walks the BO's VMAs and, in fault mode, calls xevminvalidatevma() -> xeptzapptes(). Because vm->ptroot[tile->id] is already NULL, dereferencing pt->level causes a NULL ptr deref.
Fix this by deferring xevmfreescratch() and xevmptdestroy() until after all contested VMAs have been unlinked and destroyed.
User is reporting hitting a NULL ptr deref in xeptzapptes(), which could be explained by this race.
(cherry picked from commit c2863648959489767f08892fd6e90577d2ea0b6a)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Upgrade
Upgrade
Linux kernel drm/xe/vmto a version that resolves this vulnerability.Patch c2863648959489767f08892fd6e90577d2ea0b6a
Event History
Frequently Asked Questions
What conditions are required to trigger the crash?
The race requires an external-buffer-object VMA to be queued for deferred destruction while a concurrent thread evicts the same shared buffer object. During that eviction, the rebind path must walk the buffer object's VMAs and invalidate the affected VMA in fault mode after the VM page-table root has already been destroyed.
What is the likely impact if the race occurs?
The described result is a NULL pointer dereference in xe_pt_zap_ptes() when it accesses a page-table structure after vm->pt_root has been cleared. This can crash the affected kernel execution path.
How does the fix prevent the issue?
The fix delays freeing scratch resources and destroying VM page tables until all contested VMAs have been unlinked from their buffer objects and destroyed. This prevents concurrent buffer-object eviction from finding a still-linked VMA whose VM page-table root has already been removed.