Executive brief
The Linux kernel's XE graphics driver can crash with a null pointer dereference when querying memory statistics on purged graphics buffer objects. This issue occurs on device resume or when buffer objects are marked for deletion but remain in the client's object list, causing a kernel crash that could disrupt graphics operations and system stability.
Technical details
The vulnerability is a null pointer dereference in the bo_meminfo() function within the XE DRM driver (drivers/gpu/drm/xe/xe_drm_client.c). When a buffer object is purged via the TTM pipeline, its ttm.resource pointer is set to NULL, but the object remains in the client's object list until userspace explicitly closes the GEM handle. If memory statistics are queried during this window, the code attempts to dereference bo->ttm.resource->mem_type without checking for NULL, causing an NPD. The crash is triggered when memory stats are queried (e.g., during device resume or when evicting objects marked as dontneed). The fix adds a NULL check to safely skip purged buffer objects in bo_meminfo, as they no longer consume memory that needs accounting.
Affected products
- Linux Linux kernel multiple versions prior to fix commit b5c55015d4164a0f206bcdcf2985da948b3c7837
Timeline
- 2026-06-25: other: Fix commit authored by Matthew Auld
- 2026-08-15: disclosed: CVE-2026-72359 published