CVE-2026-72358

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/pt: prevent invalid cursor access for purged BOs

During a page table walk for binding, xe_pt_stage_bind() explicitly

skips initializing the xe_res_cursor for purged BOs, treating them

similarly to NULL VMAs by only setting the cursor size.

However, xe_pt_hugepte_possible() and xe_pt_scan_64K() did not check

if the BO was purged before attempting to walk the cursor using

xe_res_dma() and xe_res_next(). Because the cursor was left

uninitialized for purged BOs, this falls through and triggers

warnings like:

WARNING: drivers/gpu/drm/xe/xe_res_cursor.h:274 at xe_res_next

Fix this by explicitly checking if the BO is purged in both

xe_pt_hugepte_possible() and xe_pt_scan_64K(), returning early just

as we do for NULL VMAs, avoiding the invalid cursor accesses entirely.

As a precaution, also zero-initialize the cursor in xe_pt_stage_bind()

to ensure we don't pass garbage data into the page table walkers

if we eve

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References