CVE-2026-99209

In the Linux kernel, the following vulnerability has been resolved: drm/xe: skip eviction of a BO with no resource xe_evict_flags() switches on tbo->resource->mem_type to choose an eviction placement. An xe BO can reach eviction with no ttm.resource, e.g. an imported dma-buf BO whose resource was freed during teardown while its attachment is still live: the exporter then invalidates it via xe_dma_buf_move_notify() -> xe_bo_evict(), and the switch dereferences a NULL resource and faults. A BO with no resource has nothing placed or mapped, so there is nothing to evict. Return an empty placement (num_placement = 0), mirroring the handling already used for non-xe scatter-gather BOs just above; ttm_bo_validate() then takes the pipeline-gutting path and returns 0. Without the fix the xe_dma_buf@xe_test_dmabuf_move_notify_no_resource dynamic live selftest will fail with below stack. BUG: kernel NULL pointer dereference, address: 0000000000000010 RIP: 0010:xe_evict_flags+0xf4/0x140 [xe] Call Trace: <TASK> xe_bo_evict+0x40/0xa0 [xe] ? ttm_bo_pipeline_gutting+0x71/0x180 [ttm] xe_test_dmabuf_move_notify_no_resource+0x182/0x440 [xe] xe_dma_buf_kunit+0x387/0x580 [xe] v2: Add Fixes tag and failure info in commit text (Matt Brost) (cherry picked from commit dbcfaac6331f1fcb0c2fe3ad3e9adb1e5d43ec0c)

• https://git.kernel.org/stable/c/448e76cbdc6652ccd3ba337b7a6e1f028859f2ed
• https://git.kernel.org/stable/c/6046bb9cb2859e3d9bf939e4d6527f3827e1096f
• https://git.kernel.org/stable/c/b6499d19ade1f1e4a1e6b739abc8c815297c98b8

Published

Oct 28, 2026

Last Modified

Oct 28, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-99203In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-99204In the Linux kernel, the following vulnerability has been re…
• CVE-2026-99205In the Linux kernel, the following vulnerability has been re…
• CVE-2026-99206In the Linux kernel, the following vulnerability has been re…
• CVE-2026-99207In the Linux kernel, the following vulnerability has been re…
• CVE-2026-99208In the Linux kernel, the following vulnerability has been re…
• CVE-2026-9921Uninitialized Use in WebGL in Google Chrome on Android prior…4.3
• CVE-2026-99210In the Linux kernel, the following vulnerability has been re…
• CVE-2026-99211In the Linux kernel, the following vulnerability has been re…
• CVE-2026-99212In the Linux kernel, the following vulnerability has been re…7
• CVE-2026-99213In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-99214In the Linux kernel, the following vulnerability has been re…