UBUNTU-CVE-2026-99209: Null Pointer Dereference

In the Linux kernel, the following vulnerability has been resolved: drm/xe: skip eviction of a BO with no resource xeevictflags() switches on tbo->resource->memtype to choose an eviction placement. An xe BO can reach eviction with no ttm.resource, e.g. an imported dma-buf BO whose resource was freed during teardown while its attachment is still live: the exporter then invalidates it via xedmabufmovenotify() -> xeboevict(), and the switch dereferences a NULL resource and faults. A BO with no resource has nothing placed or mapped, so there is nothing to evict. Return an empty placement (numplacement = 0), mirroring the handling already used for non-xe scatter-gather BOs just above; ttmbovalidate() then takes the pipeline-gutting path and returns 0. Without the fix the xedmabuf@xetestdmabufmovenotifynoresource dynamic live selftest will fail with below stack. BUG: kernel NULL pointer dereference, address: 0000000000000010 RIP: 0010:xeevictflags+0xf4/0x140 [xe] Call Trace: <TASK> xeboevict+0x40/0xa0 [xe] ? ttmbopipelinegutting+0x71/0x180 [ttm] xetestdmabufmovenotifynoresource+0x182/0x440 [xe] xedmabufkunit+0x387/0x580 [xe] v2: Add Fixes tag and failure info in commit text (Matt Brost) (cherry picked from commit dbcfaac6331f1fcb0c2fe3ad3e9adb1e5d43ec0c)