EUVD-2026-103750
GHSA-p8r6-wxq7-5fv3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocal access to Intel Xe GPU DRM interface
-
ExploitTrigger VM close concurrent with shared-BO eviction
-
ExecutionWin race reaching xe_pt_zap_ptes with NULL pt_root
-
ImpactKernel NULL pointer dereference (denial of service)
Vulnerability Assessment
| Exploitation Conditions | Requires local access on a Linux host whose GPU uses the Intel Xe (drm/xe) driver, with the driver operating in fault mode, and the attacker (or workload) able to open and tear down GPU VMs via the DRM interface. The trigger is a race: VM close-and-put must overlap with a concurrent eviction of a shared external buffer object so that xe_bo_trigger_rebind walks VMAs still linked to the BO after pt_root has been freed. Limiting factors: exploitation is local only, needs the Xe driver plus non-default fault mode, requires low-privileged GPU access, and depends on winning a narrow timing window, making reliable triggering difficult. |
| Impact | Signals point to a genuine but moderate, local-only issue rather than a top-priority emergency. The CVSS vector (AV:L/AC:L/PR:L/UI:N) correctly marks this as locally exploitable by an authenticated low-privileged user, but the C:H/I:H/A:H impact rating appears overstated: the described defect is a kernel NULL pointer dereference in xe_pt_zap_ptes() caused by a use-after-teardown race, which realistically yields a denial of service (kernel crash), not confidentiality or integrity loss - verify impact with the vendor as the auto-generated score likely inflates C/I. EPSS is low (0.20%, 9th percentile) and there is no CISA KEV listing and no public exploit identified, which is consistent with a hard-to-win concurrency race confined to a specific driver path. The vuln.today 'this_week' decision label reflects a fixed, upstream-acknowledged kernel bug that should be patched on the normal stable-update cadence, not treated as act_now/emergency. Net: real and worth patching on affected Intel Xe GPU systems, but not a widespread, remotely weaponizable threat. |
| Exploit ScenarioDerived | On a Linux system using the Intel Xe GPU driver in fault mode, a local user with GPU/DRM access triggers teardown of a VM (xe_vm_close_and_put) while a concurrent thread evicts a shared external buffer object. If the attacker wins the race, xe_bo_trigger_rebind walks the BO's still-linked VMAs and calls xe_pt_zap_ptes() after vm->pt_root has already been freed/NULLed, dereferencing a NULL pointer and crashing the kernel. No public PoC exists; the condition was observed and reported as a real-world crash rather than a crafted exploit. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 24, 2026
Local denial of service in the Linux kernel's Intel Xe graphics driver (drm/xe) can crash the host when a GPU virtual memory is torn down concurrently with eviction of a shared external buffer object. xe_vm_close_and_put() frees vm->pt_root via xe_vm_pt_destroy() before queued contested VMAs are unlinked and destroyed, so a racing xe_bo_trigger_rebind() path in fault mode walks VMAs whose page-table root is already NULL and dereferences it in xe_pt_zap_ptes(), producing a kernel NULL pointer dereference. Affected are kernels containing the Xe driver prior to the stable fixes in 6.12.112, 6.18.55, 7.2.9 and 7.3-rc5; a local user with low-privileged GPU access who can open and tear down Xe VMs is required, and the race window is narrow, so per the independent assessment the realistic outcome is availability loss rather than data compromise. EPSS is low (0.20%, 9th percentile) and no public exploit code was identified at time of analysis; vendor patches are available and tracked as this-week priority.
RemediationAI
Vendor-released patch: update to Linux 6.12.112, 6.18.55, 7.2.9 or 7.3-rc5, which contain the upstream commits 70fddc065ac80845ffd33095b3635d59883cf7e6, ba678c2b02e0d36b53deb5a6d5e5ea044d36def7, bddaa5e4094c134452c29e20a26c4718827e4cb1 and 24a22fb3c731474b68e986af6804db450fb88617 that defer xe_vm_free_scratch() and xe_vm_pt_destroy() until contested VMAs are unlinked and destroyed; the stable trees are linked from https://git.kernel.org/stable/c/70fddc065ac80845ffd33095b3635d59883cf7e6 and the record at https://nvd.nist.gov/vuln/detail/CVE-2026-98510, with distribution-specific errata to be confirmed against https://vuldb.com/vuln/422216. The supplied data identifies no alternative remedy beyond this corrective ordering change; the practical exposure boundary is that systems not running the Intel Xe driver, or not using it in fault mode, do not reach the affected path, and the race additionally requires a local principal with GPU access able to open and tear down Xe VMs, so restricting such access to trusted workloads limits reachability while patched kernels are staged.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The drm/xe driver manages GPU virtual address spaces through VM objects that hold per-tile page-table roots (vm->pt_root[tile->id]) and track buffer-object bindings in lists such as vm_bo->list.gpuva. On teardown, xe_vm_close_and_put() does not destroy external-BO VMAs inline; it queues them on a contested list for deferred destruction by xe_vma_destroy_unlocked(). The bug is an ordering error: xe_vm_free_scratch() and xe_vm_pt_destroy() ran before that contested list was drained, so page-table roots were released while VMAs were still linked to their buffer objects. A concurrent thread evicting one of those shared BOs enters xe_bo_trigger_rebind() holding only bo->resv, walks the BO's VMAs, and in fault mode calls xe_vm_invalidate_vma() and then xe_pt_zap_ptes(); with vm->pt_root[tile->id] already NULL, dereferencing pt->level faults. The corrective change defers scratch and page-table destruction until after contested VMAs have been unlinked and destroyed. The trigger is a race between VM close-and-put and concurrent BO eviction, and the underlying condition class was not assigned a CWE identifier in the supplied data. Exploitation is confined to systems running the Intel Xe driver with fault mode in use and with a local principal able to issue DRM VM open/teardown operations.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local low-privileged GPU user (AV:L/PR:L); a concurrency race gives AC:H; a NULL deref only crashes the kernel, so C:N/I:N and A:H.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
4DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
drm/xe/vm: nuke PTs only after unlinking contested VMAs
In xe_vm_close_and_put(), external-BO VMAs are queued on the contested list for deferred destruction via xe_vma_destroy_unlocked(). However, xe_vm_pt_destroy() was previously invoked before processing contested VMAs, destroying vm->pt_root while those VMAs were still linked to their respective buffer objects (vm_bo->list.gpuva).
If a concurrent thread evicts one of those shared buffer objects, xe_bo_trigger_rebind() holding only bo->resv walks the BO's VMAs and, in fault mode, calls xe_vm_invalidate_vma() -> xe_pt_zap_ptes(). Because vm->pt_root[tile->id] is already NULL, dereferencing pt->level causes a NULL ptr deref.
Fix this by deferring xe_vm_free_scratch() and xe_vm_pt_destroy() until after all contested VMAs have been unlinked and destroyed.
User is reporting hitting a NULL ptr deref in xe_pt_zap_ptes(), which could be explained by this race.
(cherry picked from commit c2863648959489767f08892fd6e90577d2ea0b6a)
Executive ViewAI
A local denial-of-service vulnerability in the Linux kernel's Intel Xe graphics driver (CVE-2026-98510) can crash affected hosts, causing availability loss. Low-privileged users with GPU access could trigger a race condition that crashes the kernel, impacting system uptime and requiring a reboot. While no public exploit code exists and the attack requires local access, organizations running affected kernels on systems with Intel GPUs should prioritize patching to maintain service availability.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB