CVE-2026-72362 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry()
The page-table walk framework may pass a NULL *child pointer for unpopulated entries. xe_pt_zap_ptes_entry() called container_of(*child) before checking for NULL, then dereferenced the result, causing a crash.
Move the container_of() call after a NULL guard, so the function returns early instead of proceeding with an invalid pointer. XE_WARN_ON is kept to help root cause the issue, but we now bail instead of crashing the driver.
v2: Comment that triggering XE_WARN_ON is unexpected behavior (Matt Brost)
(cherry picked from commit b9297d19d9df5d4b6c994648570c5dcd1cac68ff)
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability identified in the Linux kernel's graphics subsystem represents a critical null pointer dereference flaw within the intel xe driver's page table management functionality. This issue specifically affects the drm/xe/pt component where the xe_pt_zap_ptes_entry() function processes page table entries during memory management operations. The root cause stems from improper handling of unpopulated page table entries that may contain NULL child pointers during page table walks, creating a scenario where the kernel attempts to dereference invalid memory locations.
The technical implementation flaw occurs when the page-table walk framework encounters unpopulated entries and passes a NULL pointer as the child parameter to xe_pt_zap_ptes_entry(). The original code structure executed container_of(child) without first validating whether the pointer was NULL, directly leading to a kernel crash when attempting to access memory through the invalid reference. This pattern violates fundamental defensive programming principles and represents a classic null pointer dereference vulnerability that can be exploited to cause system instability.
The operational impact of this vulnerability extends beyond simple system crashes to potentially compromise the entire graphics subsystem and underlying kernel stability. When triggered, the flaw results in immediate kernel panic conditions that terminate graphics processing capabilities and may require complete system reboot for recovery. The vulnerability affects systems utilizing intel xe graphics drivers where page table management operations are actively performed, particularly during memory allocation and deallocation scenarios involving GPU virtual memory management.
The mitigation implemented addresses the core issue by reordering the function execution flow to perform NULL pointer validation before attempting container_of() operations. This change ensures that when unpopulated entries are encountered, the function returns early rather than proceeding with invalid pointer dereferencing, maintaining system stability while preserving diagnostic capabilities through the XE_WARN_ON macro. The solution follows established security practices for preventing null pointer dereferences and aligns with CWE-476 which specifically addresses NULL pointer dereference vulnerabilities in software systems.
This fix demonstrates adherence to industry best practices for kernel security management and represents a defensive programming approach that prevents potential exploitation pathways while maintaining system functionality. The implementation maintains backward compatibility through the use of warning mechanisms that assist in root cause analysis without compromising system stability, following ATT&CK framework considerations for privilege escalation prevention through kernel-level memory corruption mitigation techniques.