{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.113-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.2.9-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  drm/xe/vm: nuke PTs only after unlinking contested VMAs  In xe_vm_close_and_put(), external-BO VMAs are queued on the contested list for deferred destruction via xe_vma_destroy_unlocked(). However, xe_vm_pt_destroy() was previously invoked before processing contested VMAs, destroying vm-\u003ept_root while those VMAs were still linked to their respective buffer objects (vm_bo-\u003elist.gpuva).  If a concurrent thread evicts one of those shared buffer objects, xe_bo_trigger_rebind() holding only bo-\u003eresv walks the BO's VMAs and, in fault mode, calls xe_vm_invalidate_vma() -\u003e xe_pt_zap_ptes(). Because vm-\u003ept_root[tile-\u003eid] is already NULL, dereferencing pt-\u003elevel causes a NULL ptr deref.  Fix this by deferring xe_vm_free_scratch() and xe_vm_pt_destroy() until after all contested VMAs have been unlinked and destroyed.  User is reporting hitting a NULL ptr deref in xe_pt_zap_ptes(), which could be explained by this race.  (cherry picked from commit c2863648959489767f08892fd6e90577d2ea0b6a)",
  "id": "DEBIAN-CVE-2026-98510",
  "modified": "2026-10-19T04:47:26.299479782Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-98510"
    }
  ],
  "upstream": [
    "CVE-2026-98510"
  ]
}