Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: prevent invalid cursor access for purged BOs During a page table walk… (CVE-2026-72358)
In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: prevent invalid cursor access for purged BOs During a page table walk for binding, xe_pt_stage_bind() explicitly skips initializing the xe_res_cursor for purged BOs, treating them similarly to NULL VMAs by only setting the cursor size. However, xe_pt_hugepte_possible() and xe_pt_scan_64K() did not check if the BO was purged before attempting to walk the cursor using xe_res_dma() and xe_res_next(). Because the cursor was left uninitialized for purged BOs, this falls through and triggers warnings like: WARNING: drivers/gpu/drm/xe/xe_res_cursor.h:274 at xe_res_next Fix this by explicitly checking if the BO is purged in both xe_pt_hugepte_possible() and xe_pt_scan_64K(), returning early just as we do for NULL VMAs, avoiding the invalid cursor accesses entirely. As a precaution, also zero-initialize the cursor in xe_pt_stage_bind() to ensure we don't pass garbage data into the page table walkers if we ever hit a similar edge case in the future. (cherry picked from commit 4c7b9c6ece32440e5a435a92076d049450cd2d2e)
AI Analysis
Technical Summary
The Linux kernel vulnerability CVE-2026-72358 involves the drm/xe/pt driver where during page table walks for binding, the function xe_pt_stage_bind() skips initializing the xe_res_cursor for purged BOs, treating them like NULL VMAs by only setting cursor size. However, functions xe_pt_hugepte_possible() and xe_pt_scan_64K() failed to check if the BO was purged before using the cursor, which was left uninitialized, leading to invalid cursor accesses and kernel warnings. The fix involves adding explicit purged BO checks in these functions to return early and zero-initializing the cursor in xe_pt_stage_bind() to avoid passing garbage data.
Potential Impact
The vulnerability could cause invalid memory accesses or kernel warnings due to uninitialized cursor usage when handling purged BOs in the drm/xe/pt driver. While no known exploits are reported, this could lead to system instability or crashes related to GPU memory management.
Mitigation Recommendations
A fix has been implemented in the Linux kernel by adding explicit checks for purged BOs in the affected functions and zero-initializing the cursor to prevent invalid accesses. Users should update to a Linux kernel version that includes this patch once available. Patch status is not yet confirmed from vendor advisory; check official Linux kernel releases for the fix.
Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: prevent invalid cursor access for purged BOs During a page table walk… (CVE-2026-72358)
Description
In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: prevent invalid cursor access for purged BOs During a page table walk for binding, xe_pt_stage_bind() explicitly skips initializing the xe_res_cursor for purged BOs, treating them similarly to NULL VMAs by only setting the cursor size. However, xe_pt_hugepte_possible() and xe_pt_scan_64K() did not check if the BO was purged before attempting to walk the cursor using xe_res_dma() and xe_res_next(). Because the cursor was left uninitialized for purged BOs, this falls through and triggers warnings like: WARNING: drivers/gpu/drm/xe/xe_res_cursor.h:274 at xe_res_next Fix this by explicitly checking if the BO is purged in both xe_pt_hugepte_possible() and xe_pt_scan_64K(), returning early just as we do for NULL VMAs, avoiding the invalid cursor accesses entirely. As a precaution, also zero-initialize the cursor in xe_pt_stage_bind() to ensure we don't pass garbage data into the page table walkers if we ever hit a similar edge case in the future. (cherry picked from commit 4c7b9c6ece32440e5a435a92076d049450cd2d2e)
CVSS v3.1
Score 7.8high
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel vulnerability CVE-2026-72358 involves the drm/xe/pt driver where during page table walks for binding, the function xe_pt_stage_bind() skips initializing the xe_res_cursor for purged BOs, treating them like NULL VMAs by only setting cursor size. However, functions xe_pt_hugepte_possible() and xe_pt_scan_64K() failed to check if the BO was purged before using the cursor, which was left uninitialized, leading to invalid cursor accesses and kernel warnings. The fix involves adding explicit purged BO checks in these functions to return early and zero-initializing the cursor in xe_pt_stage_bind() to avoid passing garbage data.
Potential Impact
The vulnerability could cause invalid memory accesses or kernel warnings due to uninitialized cursor usage when handling purged BOs in the drm/xe/pt driver. While no known exploits are reported, this could lead to system instability or crashes related to GPU memory management.
Mitigation Recommendations
A fix has been implemented in the Linux kernel by adding explicit checks for purged BOs in the affected functions and zero-initializing the cursor to prevent invalid accesses. Users should update to a Linux kernel version that includes this patch once available. Patch status is not yet confirmed from vendor advisory; check official Linux kernel releases for the fix.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-p58g-v37m-9wmc
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-72358"]
Threat ID: 6a808b70bf8831d5394fb10d
Added to database: 08/15/2026, 15:53:20 UTC
Last enriched: 08/15/2026, 16:33:19 UTC
Last updated: 09/30/2026, 06:54:41 UTC
Views: 21
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.