Skip to main content

Linux Kernel CVE-2026-72358

| EUVDEUVD-2026-59257 HIGH
2026-08-15 Linux GHSA-p58g-v37m-9wmc
Information Disclosure Linux Red Hat Suse
High
Disputed · 7.8 Vendor: Linux
Share

Severity by source

Sources disagree (Low–High)
Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local low-privilege access required to interact with the GPU driver; uninitialized kernel page table cursor yields worst-case H/H/H impact ceiling with no scope change beyond the kernel itself.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
3.3 LOW
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Red Hat
5.5 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 08:46 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
7.8 (HIGH)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 05:55 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 15, 2026 - 05:55 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/pt: prevent invalid cursor access for purged BOs

During a page table walk for binding, xe_pt_stage_bind() explicitly skips initializing the xe_res_cursor for purged BOs, treating them similarly to NULL VMAs by only setting the cursor size.

However, xe_pt_hugepte_possible() and xe_pt_scan_64K() did not check if the BO was purged before attempting to walk the cursor using xe_res_dma() and xe_res_next(). Because the cursor was left uninitialized for purged BOs, this falls through and triggers warnings like:

WARNING: drivers/gpu/drm/xe/xe_res_cursor.h:274 at xe_res_next

Fix this by explicitly checking if the BO is purged in both xe_pt_hugepte_possible() and xe_pt_scan_64K(), returning early just as we do for NULL VMAs, avoiding the invalid cursor accesses entirely.

As a precaution, also zero-initialize the cursor in xe_pt_stage_bind() to ensure we don't pass garbage data into the page table walkers if we ever hit a similar edge case in the future.

(cherry picked from commit 4c7b9c6ece32440e5a435a92076d049450cd2d2e)

AnalysisAI

Invalid cursor access in the Linux kernel's Intel Xe GPU (drm/xe) page table subsystem allows local low-privileged users to trigger kernel warnings and potentially exploit uninitialized memory during page table binding walks involving purged buffer objects. Affected kernel versions span Linux 7.1 up to the fix points in 7.1.5 and 7.2-rc2, and only systems equipped with Intel Xe GPU hardware are at risk. No public exploit identified at time of analysis; EPSS at 0.20% (10th percentile) reflects minimal current exploitation interest, though the kernel memory-management context elevates the theoretical impact ceiling.

Technical ContextAI

The Linux kernel's drm/xe subsystem is the DRM (Direct Rendering Manager) driver for Intel's Xe GPU architecture, covering Intel Arc discrete GPUs and Xe-class integrated graphics. In GPU memory management, buffer objects (BOs) can be purged - evicted and invalidated under memory pressure - leaving them without valid backing storage. The vulnerable code path is in xe_pt_stage_bind(), which walks page tables to bind GPU virtual memory ranges. This function correctly skips initializing the xe_res_cursor for purged BOs, but two callees - xe_pt_hugepte_possible() and xe_pt_scan_64K() - did not guard against the purged-BO state before invoking xe_res_dma() and xe_res_next() on that cursor. The root cause is functionally analogous to CWE-908 (use of uninitialized resource): garbage cursor data drives page table decisions, producing kernel warnings at xe_res_cursor.h:274 and creating the conditions for undefined memory behavior. The affected kernel range per EUVD is Linux 7.1, from commit ad9843aac91a1eda12912a4922042ea04cfc29dc up to but not including stable commits 2b6b3f98d0e93856bee38699b783c71cb0e9d67f and 8a0fb57675be578c4db19deb4298ed08a70f0f1a. CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

The primary fix is to upgrade to Linux kernel 7.1.5 (stable) or 7.2-rc2 and later, which incorporate cherry-picked commit 4c7b9c6ece32440e5a435a92076d049450cd2d2e. The upstream stable patch commits are available at https://git.kernel.org/stable/c/2b6b3f98d0e93856bee38699b783c71cb0e9d67f and https://git.kernel.org/stable/c/8a0fb57675be578c4db19deb4298ed08a70f0f1a; distribution-packaged kernel updates from vendors tracking these stable branches are the recommended delivery path. For systems where an immediate kernel upgrade is not feasible, blacklisting the xe module (modprobe -r xe followed by adding 'blacklist xe' to /etc/modprobe.d/) eliminates the attack surface entirely but disables Intel Xe GPU hardware acceleration, requiring fallback to software rendering - acceptable for headless or non-GPU-workload servers, disruptive for GPU-dependent workloads. Restricting GPU device node access via udev rules (MODE=0660, GROUP=video) limits which users can interact with the GPU subsystem, reducing but not eliminating exposure for users already in the video group. Applying the vendor-released kernel patch (Linux 7.1.5) via standard distribution channels is the recommended and lowest-risk remediation path.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Low
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-72358 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy