In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: nuke PTs only after unlinking contested VMAs In… (CVE-2026-98510)

The vulnerability in the Linux kernel's drm/xe VM subsystem occurred because xe_vm_pt_destroy() was called before contested VMAs were unlinked and destroyed. This led to vm->pt_root being NULL while VMAs were still linked to buffer objects. Concurrent eviction of these buffer objects caused xe_pt_zap_ptes() to dereference a NULL pointer, resulting in a kernel NULL pointer dereference. The patch defers calls to xe_vm_free_scratch() and xe_vm_pt_destroy() until after contested VMAs are fully processed, preventing the race condition and NULL pointer dereference.

This vulnerability can cause a NULL pointer dereference in kernel space, leading to system crashes or denial of service. There is no indication of privilege escalation or arbitrary code execution. No known exploits in the wild have been reported.

A fix has been applied in the Linux kernel to defer destruction of page tables until after contested VMAs are unlinked and destroyed. Users should update to the patched kernel version containing commit c2863648959489767f08892fd6e90577d2ea0b6a or later. Patch status is not explicitly confirmed in the input, so users should consult the vendor advisory or kernel changelogs for the exact fixed versions.