Linux Kernel Xe Page Table xe_res_cursor.h xe_pt_hugepte_possible/xe_pt_scan_64K uninitialized pointer

Summaryinfo

A vulnerability marked as very critical has been reported in Linux Kernel. The affected element is the function xe_pt_hugepte_possible/xe_pt_scan_64K of the file drivers/gpu/drm/xe/xe_res_cursor.h of the component Xe Page Table. The manipulation leads to uninitialized pointer. This vulnerability is uniquely identified as CVE-2026-72358. Local access is required to approach this attack. No exploit exists.

Detailsinfo

A vulnerability, which was classified as very critical, has been found in Linux Kernel (the affected version is unknown). This issue affects the function xe_pt_hugepte_possible/xe_pt_scan_64K of the file drivers/gpu/drm/xe/xe_res_cursor.h of the component Xe Page Table. The manipulation with an unknown input leads to a uninitialized pointer vulnerability. Using CWE to declare the problem leads to CWE-824. The product accesses or uses a pointer that has not been initialized. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: prevent invalid cursor access for purged BOs During a page table walk for binding, xe_pt_stage_bind() explicitly skips initializing the xe_res_cursor for purged BOs, treating them similarly to NULL VMAs by only setting the cursor size. However, xe_pt_hugepte_possible() and xe_pt_scan_64K() did not check if the BO was purged before attempting to walk the cursor using xe_res_dma() and xe_res_next(). Because the cursor was left uninitialized for purged BOs, this falls through and triggers warnings like: WARNING: drivers/gpu/drm/xe/xe_res_cursor.h:274 at xe_res_next Fix this by explicitly checking if the BO is purged in both xe_pt_hugepte_possible() and xe_pt_scan_64K(), returning early just as we do for NULL VMAs, avoiding the invalid cursor accesses entirely. As a precaution, also zero-initialize the cursor in xe_pt_stage_bind() to ensure we don't pass garbage data into the page table walkers if we ever hit a similar edge case in the future. (cherry picked from commit 4c7b9c6ece32440e5a435a92076d049450cd2d2e)

The advisory is shared at git.kernel.org. The identification of this vulnerability is CVE-2026-72358 since 08/09/2026. The exploitation is known to be easy. An attack has to be approached locally. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/15/2026).

Applying the patch 4c7b9c6ece32440e5a435a92076d049450cd2d2e/2b6b3f98d0e93856bee38699b783c71cb0e9d67f is able to eliminate this problem.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion