CVE-2026-99209

Что произошло

In the Linux kernel, the following vulnerability has been resolved: drm/xe: skip eviction of a BO with no resource xe_evict_flags() switches on tbo->resource->mem_type to choose an eviction placement. An xe BO can reach eviction with no ttm.resource, e.g. an imported dma-buf BO whose resource was freed during teardown while its attachment is still live: the exporter then invalidates it via xe_dma_buf_move_notify() -> xe_bo_evict(), and the switch dereferences a NULL resource and faults. A BO with no resource has nothing placed or mapped, so there is nothing to evict. Return an empty placement (num_placement = 0), mirroring the handling already used for non-xe scatter-gather BOs just above; ttm_bo_validate() then takes the pipeline-gutting path and returns 0. Without the fix the xe_dma_buf@xe_test_dmabuf_move_notify_no_resource dynamic live selftest will fail with below stack. BUG: kernel NULL pointer dereference, address: 0000000000000010 RIP: 0010:xe_evict_flags+0xf4/0x140 [xe] Call Trace: xe_bo_evict+0x40/0xa0 [xe] ? ttm_bo_pipeline_gutting+0x71/0x180 [ttm] xe_test_dmabuf_move_notify_no_resource+0x182/0x440 [xe] xe_dma_buf_kunit+0x387/0x580 [xe] v2: Add Fixes tag and failure info in commit text (Matt Brost) (cherry picked from commit dbcfaac6331f1fcb0c2fe3ad3e9adb1e5d43ec0c)

Что делать

dpkg-query -W -f='${Package}	${Version}\n'

rpm -qa --qf '%{NAME}\t%{VERSION}-%{RELEASE}\n'

Get-HotFix | Select-Object HotFixID, InstalledOn

Продукты и затронутые версии

{
  "status": "affected",
  "version": "dd08ebf6c3525a7ea2186e636df064ea47281987",
  "lessThan": "6046bb9cb2859e3d9bf939e4d6527f3827e1096f",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "dd08ebf6c3525a7ea2186e636df064ea47281987",
  "lessThan": "b6499d19ade1f1e4a1e6b739abc8c815297c98b8",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "dd08ebf6c3525a7ea2186e636df064ea47281987",
  "lessThan": "448e76cbdc6652ccd3ba337b7a6e1f028859f2ed",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "6.8"
}

{
  "status": "unaffected",
  "version": "0",
  "lessThan": "6.8",
  "versionType": "semver"
}

{
  "status": "unaffected",
  "version": "6.18.59",
  "versionType": "semver",
  "lessThanOrEqual": "6.18.*"
}

{
  "status": "unaffected",
  "version": "7.2.13",
  "versionType": "semver",
  "lessThanOrEqual": "7.2.*"
}

{
  "status": "unaffected",
  "version": "7.3",
  "versionType": "original_commit_for_fix",
  "lessThanOrEqual": "*"
}

CVSS: оценки и векторы

Оценка CVSS отсутствует.

Источники и ссылки

{
  "cwes": [],
  "epss": {
    "source": "epss",
    "received_at": "2026-11-01T21:13:24.333102+00:00"
  },
  "title": {
    "source": "cve",
    "received_at": "2026-10-28T20:51:05.318907+00:00"
  },
  "scores": [],
  "status": {
    "source": "cve",
    "received_at": "2026-10-28T20:51:05.318907+00:00"
  },
  "affected": [
    "cve"
  ],
  "published": {
    "source": "cve",
    "received_at": "2026-10-28T20:51:05.318907+00:00"
  },
  "solutions": [],
  "percentile": {
    "source": "epss",
    "received_at": "2026-11-01T21:13:24.333102+00:00"
  },
  "references": [
    "cve",
    "ghsa",
    "nvd"
  ],
  "description": {
    "source": "cve",
    "received_at": "2026-10-28T20:51:05.318907+00:00"
  },
  "workarounds": [],
  "configurations": []
}

Хронология записи

1. Данные обновлены02.11.2026, 00:13
2. Данные обновлены31.10.2026, 12:00
3. Данные обновлены28.10.2026, 23:51
4. Данные обновлены28.10.2026, 18:00
5. Опубликована28.10.2026, 15:17

Личная заметка и статус

Другие CVE того же продукта