{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "ad9843aac91a1eda12912a4922042ea04cfc29dc"
            },
            {
              "fixed": "2b6b3f98d0e93856bee38699b783c71cb0e9d67f"
            },
            {
              "fixed": "8a0fb57675be578c4db19deb4298ed08a70f0f1a"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.1.0"
            },
            {
              "fixed": "7.1.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72358.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/pt: prevent invalid cursor access for purged BOs\n\nDuring a page table walk for binding, xe_pt_stage_bind() explicitly\nskips initializing the xe_res_cursor for purged BOs, treating them\nsimilarly to NULL VMAs by only setting the cursor size.\n\nHowever, xe_pt_hugepte_possible() and xe_pt_scan_64K() did not check\nif the BO was purged before attempting to walk the cursor using\nxe_res_dma() and xe_res_next(). Because the cursor was left\nuninitialized for purged BOs, this falls through and triggers\nwarnings like:\n\n  WARNING: drivers/gpu/drm/xe/xe_res_cursor.h:274 at xe_res_next\n\nFix this by explicitly checking if the BO is purged in both\nxe_pt_hugepte_possible() and xe_pt_scan_64K(), returning early just\nas we do for NULL VMAs, avoiding the invalid cursor accesses entirely.\n\nAs a precaution, also zero-initialize the cursor in xe_pt_stage_bind()\nto ensure we don't pass garbage data into the page table walkers\nif we ever hit a similar edge case in the future.\n\n(cherry picked from commit 4c7b9c6ece32440e5a435a92076d049450cd2d2e)",
  "id": "CVE-2026-72358",
  "modified": "2026-08-16T03:31:20.327771142Z",
  "published": "2026-08-15T05:55:58.783Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2b6b3f98d0e93856bee38699b783c71cb0e9d67f"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8a0fb57675be578c4db19deb4298ed08a70f0f1a"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72358.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72358"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "summary": "drm/xe/pt: prevent invalid cursor access for purged BOs"
}