{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-72358", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.921Z", "datePublished": "2026-08-15T05:55:58.783Z", "dateUpdated": "2026-08-17T05:43:16.546Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:43:16.546Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/pt: prevent invalid cursor access for purged BOs\n\nDuring a page table walk for binding, xe_pt_stage_bind() explicitly\nskips initializing the xe_res_cursor for purged BOs, treating them\nsimilarly to NULL VMAs by only setting the cursor size.\n\nHowever, xe_pt_hugepte_possible() and xe_pt_scan_64K() did not check\nif the BO was purged before attempting to walk the cursor using\nxe_res_dma() and xe_res_next(). Because the cursor was left\nuninitialized for purged BOs, this falls through and triggers\nwarnings like:\n\n WARNING: drivers/gpu/drm/xe/xe_res_cursor.h:274 at xe_res_next\n\nFix this by explicitly checking if the BO is purged in both\nxe_pt_hugepte_possible() and xe_pt_scan_64K(), returning early just\nas we do for NULL VMAs, avoiding the invalid cursor accesses entirely.\n\nAs a precaution, also zero-initialize the cursor in xe_pt_stage_bind()\nto ensure we don't pass garbage data into the page table walkers\nif we ever hit a similar edge case in the future.\n\n(cherry picked from commit 4c7b9c6ece32440e5a435a92076d049450cd2d2e)" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - Exploitation requires local ioctl access to the Intel Xe DRM render node (/dev/dri/renderD*) via XE_VM_BIND and XE_MADVISE to drive purged-buffer page-table rebinds through xe_pt_stage_bind(); this path is not reachable over the network or without local GPU device access.\nAC:L - An attacker controls the full trigger sequence—marking BOs DONTNEED via madvise, inducing memory pressure to purge backing store, and forcing rebind—so the uninitialized-cursor walk is reliably reachable without races or conditions outside attacker influence.\nPR:L - Only standard unprivileged local access to the DRM render node is required (typical render/video group membership on desktops, cloud GPU instances, and shared workstations); no real root/CAP_SYS_ADMIN and user namespaces do not grant additional reach.\nUI:N - No victim or administrator interaction is needed; the attacker drives the entire sequence through their own DRM ioctls and deliberate memory-pressure to purge and rebind their own mapped buffer objects.\nS:U - Impact is kernel memory corruption and denial-of-service within the same OS security boundary (potential local privilege escalation), not a VM escape, IOMMU/DMA boundary bypass, or cross-tenant isolation break.\nC:H - xe_pt_hugepte_possible() and xe_pt_scan_64K() read uninitialized xe_res_cursor stack fields via xe_res_dma()/xe_res_next() on purged BOs, constituting kernel memory corruption that can leak adjacent stack/heap data or skew page-table decisions.\nI:H - Garbage cursor mem_type/node pointers drive buddy-allocator list traversal during page-table walks, enabling kernel heap metadata corruption and potential arbitrary write or control-flow hijack primitives beyond the intended safe NULL/scratch PTE rebind path.\nA:H - Invalid cursor traversal triggers XE_WARN_ON in xe_res_next and can dereference corrupt buddy-list pointers during purged-BO rebind, causing kernel warnings, oops, or panic and denying GPU and system availability." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/xe/xe_pt.c" ], "versions": [ { "version": "ad9843aac91a1eda12912a4922042ea04cfc29dc", "lessThan": "2b6b3f98d0e93856bee38699b783c71cb0e9d67f", "status": "affected", "versionType": "git" }, { "version": "ad9843aac91a1eda12912a4922042ea04cfc29dc", "lessThan": "8a0fb57675be578c4db19deb4298ed08a70f0f1a", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/xe/xe_pt.c" ], "versions": [ { "version": "7.1", "status": "affected" }, { "version": "0", "lessThan": "7.1", "status": "unaffected", "versionType": "semver" }, { "version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.1.5" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.2" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/2b6b3f98d0e93856bee38699b783c71cb0e9d67f" }, { "url": "https://git.kernel.org/stable/c/8a0fb57675be578c4db19deb4298ed08a70f0f1a" } ], "title": "drm/xe/pt: prevent invalid cursor access for purged BOs", "x_generator": { "engine": "bippy-1.2.0" } } } }