CVE-2026-72359 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/xe: fix NPD in bo_meminfo()
When a buffer object is purged, its ttm.resource is set to NULL via the TTM pipeline gutting flow. However, the BO remains in the client's object list until userspace explicitly closes the GEM handle. If memory stats are queried during this time, accessing bo->ttm.resource->mem_type will result in a NULL pointer dereference.
Fix this by safely skipping purged BOs in bo_meminfo, as they no longer consume any memory.
User is getting NPD on device resume, and possible theory is that in bo_move(), if we need to evict something to SYSTEM to save the CCS state, but the BO is marked as dontneed, this won't trigger a move but will nuke the pages, leaving us with a NULL bo resource. And the meminfo() doesn't look ready to handle a NULL resource.
v2 (Sashiko): - There could potentially be other cases where we might end up with a NULL resource, so make this a general NULL check for now.
(cherry picked from commit c9a8e7daa0afe3161111e27fd92176e608c7f186)
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability described represents a null pointer dereference condition in the Linux kernel's graphics subsystem, specifically within the intel xe driver's buffer object memory management functionality. This issue occurs when querying memory statistics for buffer objects that have been purged but not yet removed from the client's object list. The problem stems from the TTM (Translation Table Manager) pipeline's gutting flow which sets the ttm.resource pointer to NULL for purged buffer objects, while the buffer object itself remains accessible through the user space GEM handle until explicit closure occurs.
The technical flaw manifests when the bo_meminfo() function attempts to access bo->ttm.resource->mem_type without proper null checking, resulting in a kernel panic or system crash. This occurs because the memory management subsystem does not account for the transitional state where buffer objects have been purged but still exist in user space handles. The vulnerability is particularly critical during device resume operations where memory statistics are queried, as demonstrated by the reported NPD (Null Pointer Dereference) conditions that can occur when the system attempts to restore graphics state while buffer objects remain in an inconsistent memory management state.
The operational impact of this vulnerability extends beyond simple system crashes to potentially destabilize graphics operations and device power management sequences. When buffer objects are marked with dontneed flags during eviction operations, the system may remove pages without triggering proper move operations, leaving behind NULL resource pointers that subsequent memory queries cannot handle gracefully. This creates a race condition between kernel memory management and user space handle closure that can lead to complete system hangs or unexpected termination.
The fix implemented addresses this by introducing explicit null pointer checks within the bo_meminfo() function to safely skip purged buffer objects that no longer consume actual memory resources. This approach aligns with established security practices for handling transitional object states in kernel memory management systems and prevents the NULL pointer dereference from occurring when querying statistics for objects that have been logically purged but not yet physically removed from the system's tracking mechanisms. The solution follows the principle of defensive programming by ensuring that all resource access operations include proper validation before dereferencing pointers, thereby preventing potential exploitation through crafted memory queries.
This vulnerability type maps to CWE-476 which describes NULL pointer dereference conditions in software systems. The fix demonstrates proper error handling and state validation practices that align with ATT&CK technique T1059.006 for kernel-based attacks that exploit memory management flaws, as it prevents potential escalation paths through improper resource handling in graphics subsystems.
The cherry-picked commit implements a general null check approach rather than addressing specific cases, which provides broader protection against similar issues that might arise from other code paths leading to NULL resource states. This defensive programming approach ensures that the kernel's graphics memory management remains robust even when encountering unexpected object state transitions and prevents potential denial of service conditions during critical operations such as device resume sequences where memory statistics are actively queried.
The fix maintains system stability by ensuring that purged buffer objects do not contribute to memory accounting calculations, which is appropriate since these objects no longer consume actual memory resources despite still being tracked in user space. This approach prevents false positive memory usage reporting while maintaining the integrity of the graphics subsystem's resource management and device power state transitions.