CVE-2026-72311

A flaw was found in the Linux kernel's drm/xe driver. A local user could trigger a memory leak by repeatedly making ioctl calls that fail the L2 flush validation. This improper memory management can lead to a Denial of Service DoS due to resource exhaustion...

CVE-2026-72359

A flaw was found in the Linux kernel's drm/xe graphics driver. A local user could trigger a NULL pointer dereference when querying memory statistics for a buffer object that has been purged. This issue arises because the driver attempts to access a NULL resource, which can lead to a system crash...

Linux Distros Unpatched Vulnerability : CVE-2026-72358

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: prevent invalid cursor access for purged BOs During a page table walk for binding...

CVE-2026-74440

A flaw was found in the Linux kernel's drm/xe driver. The xeexecioctl function did not properly wait on kernel fences for external Buffer Objects BOs. This oversight allows a local attacker to initiate a user job that races with ongoing kernel memory management operations on external BOs. A...

CVE-2026-74440

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Wait on external BO kernel fences in exec IOCTL Before arming a user job, xeexecioctl only added the VM's dma-resv KERNEL slot as a dependency. That slot covers rebinds and the kernel operations of the VM's private BOs, b...

CVE-2026-72358

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: prevent invalid cursor access for purged BOs During a page table walk for binding, xeptstagebind explicitly skips initializing the xerescursor for purged BOs, treating them similarly to NULL VMAs by only setting the...

CVE-2026-72362

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: Fix NULL pointer dereference in xeptzapptesentry The page-table walk framework may pass a NULL child pointer for unpopulated entries. xeptzapptesentry called containerofchild before checking for NULL, then dereferenced...

UBUNTU-CVE-2026-72358

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: prevent invalid cursor access for purged BOs During a page table walk for binding, xeptstagebind explicitly skips initializing the xerescursor for purged BOs, treating them similarly to NULL VMAs by only setting the...

UBUNTU-CVE-2026-72362

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: Fix NULL pointer dereference in xeptzapptesentry The page-table walk framework may pass a NULL child pointer for unpopulated entries. xeptzapptesentry called containerofchild before checking for NULL, then dereferenced...

UBUNTU-CVE-2026-72359

In the Linux kernel, the following vulnerability has been resolved: drm/xe: fix NPD in bomeminfo When a buffer object is purged, its ttm.resource is set to NULL via the TTM pipeline gutting flow. However, the BO remains in the client's object list until userspace explicitly closes the GEM handle...

CVE-2026-72362

The CVE-2026-72362 issue affects the Linux kernel DRM/XE PT path (xe_pt_zap_ptes_entry). The vulnerability arises when a NULL child pointer for unpopulated entries is dereferenced because container_of(*child) is called before a NULL check, causing a crash. The fix moves the container_of() call af...

CVE-2026-72358

CVE-2026-72358 relates to the Linux kernel drm/xe/pt code, where cursor handling for purged BOs could be left uninitialized during page-table walks in xe_pt_hugepte_possible() and xe_pt_scan_64K(), leading to invalid cursor accesses and warnings. The fix adds an explicit purged-BO check (like NUL...

PT-2026-72550

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: Fix NULL pointer dereference in xe pt zap ptes entry The page-table walk framework may pass a NULL child pointer for unpopulated entries. xe pt zap ptes entry called container ofchild before checking for NULL, then...

Linux Distros Unpatched Vulnerability : CVE-2026-74440

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/xe: Wait on external BO kernel fences in exec IOCTL Before arming a user job, xeexecioctl only added the VM's dma-resv KERNEL slot as a dependency. That slo...

Linux Distros Unpatched Vulnerability : CVE-2026-68274

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/xe/guc: Fix buffer overflow in steered register list allocation The size calculation for the steered register extarray uses only the geometry DSS mask...

Linux Distros Unpatched Vulnerability : CVE-2026-68268

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/xe: Return error on non-migratable faults requiring devmem Non-migratable faults that require devmem incorrectly jump to the 'out' label, which squashes the...

DEBIAN-CVE-2026-68384

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Fix VF CCS attach/detach race with in-flight BO moves xebomove attaches VF CCS read/write batch buffers BBs to a BO after it transitions NULL/SYSTEM - TT, and detaches them after it transitions TT - SYSTEM. Both...

DEBIAN-CVE-2026-68268

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Return error on non-migratable faults requiring devmem Non-migratable faults that require devmem incorrectly jump to the 'out' label, which squashes the error code intended to be returned to the upper layers. Fix this by...

UBUNTU-CVE-2026-68267

In the Linux kernel, the following vulnerability has been resolved: drm/xe/rtp: Add RINGFORCETONONPRIVDENY to OA whitelists Unconditionally whitelisting OA registers is a security violation. Set RINGFORCETONONPRIVDENY bit in OA nonpriv slots, so that OA registers don't get whitelisted by default...

UBUNTU-CVE-2026-68266

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Hold a dma-buf reference for imported BOs An imported dma-buf BO is created as a ttmbotypesg BO whose reservation object is the exporter's dmabuf-resv. The importer, however, only takes a dma-buf reference after a...