CVE-2026-98510 Overview
CVE-2026-98510 is a NULL pointer dereference vulnerability in the Linux kernel's drm/xe graphics driver subsystem. The flaw resides in the virtual memory (VM) teardown logic within xe_vm_close_and_put(). The function previously destroyed the page table root (vm->pt_root) before unlinking contested virtual memory areas (VMAs) tied to external buffer objects (BOs). A concurrent eviction of a shared BO can trigger xe_bo_trigger_rebind(), which walks the BO's VMAs and calls xe_vm_invalidate_vma() followed by xe_pt_zap_ptes(). Because vm->pt_root[tile->id] has already been freed, dereferencing pt->level causes a kernel crash.
Critical Impact
A race condition in the Intel Xe GPU driver can cause a kernel NULL pointer dereference, resulting in a denial-of-service crash of the host system.
Affected Products
- Linux kernel versions containing the drm/xe driver prior to the fix
- Systems using Intel Xe-based graphics hardware
- Stable kernel branches that received the backport (see referenced commits)
Discovery Timeline
- 2026-10-18 - CVE-2026-98510 published to NVD
- 2026-10-19 - Last updated in NVD database
Technical Details for CVE-2026-98510
Vulnerability Analysis
The defect is a classic ordering bug between resource destruction and concurrent access in the Intel Xe DRM driver. During VM shutdown, xe_vm_close_and_put() queues external-BO VMAs on a contested list for deferred cleanup via xe_vma_destroy_unlocked(). The original code invoked xe_vm_pt_destroy() before draining that contested list. As a result, the VM's page table root was freed while VMAs still referenced the live buffer objects through vm_bo->list.gpuva.
Another thread holding only the BO reservation lock (bo->resv) can race with this teardown. If that thread evicts the shared BO, xe_bo_trigger_rebind() iterates the BO's remaining VMAs. In fault mode, it reaches xe_vm_invalidate_vma() and then xe_pt_zap_ptes(), which reads pt->level from the already-freed vm->pt_root. The dereference crashes the kernel.
Root Cause
The root cause is incorrect destruction ordering [CWE-476]. Page table structures were released before all referencing VMAs were unlinked, violating the lifetime invariant that vm->pt_root must outlive any VMA capable of invoking page table operations.
Attack Vector
Triggering the condition requires a concurrent eviction of a shared buffer object during VM close on a system using the Xe driver in fault mode. The window is narrow and typically arises under GPU memory pressure with multiple contexts sharing external BOs. A user reportedly hit this NULL pointer dereference in production, confirming the race is reachable without special privileges beyond normal GPU access.
See the upstream fix for implementation details: Kernel Git Commit c2863648.
Detection Methods for CVE-2026-98510
Indicators of Compromise
- Kernel oops or panic messages referencing xe_pt_zap_ptes in the call stack
- NULL pointer dereference backtraces that include xe_vm_invalidate_vma and xe_bo_trigger_rebind
- Unexpected GPU driver crashes on systems with Intel Xe graphics under memory pressure
Detection Strategies
- Collect and parse /var/log/kern.log and dmesg output for crash signatures involving the Xe driver teardown path.
- Monitor system reboot frequency on Xe-equipped hosts and correlate with workloads that heavily share GPU buffer objects.
- Enable kdump to capture vmcores for any crash in the drm/xe subsystem for root-cause confirmation.
Monitoring Recommendations
- Track kernel version inventory across endpoints to identify hosts missing the backported fix.
- Alert on repeated GPU driver resets or xe module faults via host telemetry pipelines.
- Forward kernel ring buffer events to a centralized log platform for pattern analysis.
How to Mitigate CVE-2026-98510
Immediate Actions Required
- Update to a Linux kernel version that includes the backport commits referenced in the NVD entry.
- Audit affected systems running Intel Xe graphics, particularly those with GPU-accelerated workloads using shared buffer objects.
- Schedule reboots after patch deployment to ensure the fixed kernel module is active.
Patch Information
The fix defers xe_vm_free_scratch() and xe_vm_pt_destroy() until after all contested VMAs have been unlinked and destroyed. Backports are available in the following stable tree commits: 24a22fb3, 70fddc0, ba678c2, and bddaa5e. Apply the vendor-supplied kernel update appropriate for your distribution.
Workarounds
- No supported upstream workaround exists; applying the patched kernel is the recommended remediation.
- Where patching is delayed, avoid GPU workloads that heavily share external buffer objects across contexts to reduce race likelihood.
- Consider disabling fault mode on the Xe driver if operationally acceptable, as the crash path depends on fault-mode invalidation.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
