Executive brief
The Linux kernel's DRM driver for Intel GPUs (Xe) contained a NULL pointer dereference bug in page table management code. When handling unpopulated page table entries during memory operations, the driver could crash instead of gracefully skipping them. This could cause GPU driver failures and system instability.
Technical details
The vulnerability is a NULL pointer dereference in the xe_pt_zap_ptes_entry() function within the Intel Xe DRM driver. The page-table walk framework may legitimately pass a NULL child pointer for unpopulated entries, but the vulnerable code called container_of(*child) before checking for NULL, then immediately dereferenced the result. An attacker with ability to trigger memory operations (such as GPU memory deallocation or migration) on unpopulated page table regions could cause a kernel crash. The fix moves the NULL check before the container_of() call, allowing the function to return early instead of proceeding with an invalid pointer. Patches are available in Linux stable trees and mainline.
Affected products
- Linux Linux kernel 5.0 and later (drm/xe driver) prior to 2026-07-01
Timeline
- 2026-08-15: disclosed: CVE-2026-72362 disclosed
- 2026-07-01: patched: Fix merged into Linux mainline by Thomas Hellström
- 2026-06-16: patched: Patch authored by Francois Dugast