{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  drm/xe: skip eviction of a BO with no resource  xe_evict_flags() switches on tbo-\u003eresource-\u003emem_type to choose an eviction placement. An xe BO can reach eviction with no ttm.resource, e.g. an imported dma-buf BO whose resource was freed during teardown while its attachment is still live: the exporter then invalidates it via xe_dma_buf_move_notify() -\u003e xe_bo_evict(), and the switch dereferences a NULL resource and faults.  A BO with no resource has nothing placed or mapped, so there is nothing to evict. Return an empty placement (num_placement = 0), mirroring the handling already used for non-xe scatter-gather BOs just above; ttm_bo_validate() then takes the pipeline-gutting path and returns 0.  Without the fix the xe_dma_buf@xe_test_dmabuf_move_notify_no_resource dynamic live selftest will fail with below stack.  BUG: kernel NULL pointer dereference, address: 0000000000000010 RIP: 0010:xe_evict_flags+0xf4/0x140 [xe] Call Trace:  \u003cTASK\u003e  xe_bo_evict+0x40/0xa0 [xe]  ? ttm_bo_pipeline_gutting+0x71/0x180 [ttm]  xe_test_dmabuf_move_notify_no_resource+0x182/0x440 [xe]  xe_dma_buf_kunit+0x387/0x580 [xe]  v2: Add Fixes tag and failure info in commit text (Matt Brost)  (cherry picked from commit dbcfaac6331f1fcb0c2fe3ad3e9adb1e5d43ec0c)",
  "id": "DEBIAN-CVE-2026-99209",
  "modified": "2026-10-29T05:47:26.759837201Z",
  "published": "2026-10-28T11:17:42.290Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-99209"
    }
  ],
  "upstream": [
    "CVE-2026-99209"
  ]
}