CVE-2026-99209

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/xe: skip eviction of a BO with no resource<br /> <br /> xe_evict_flags() switches on tbo-&gt;resource-&gt;mem_type to choose an<br /> eviction placement. An xe BO can reach eviction with no ttm.resource,<br /> e.g. an imported dma-buf BO whose resource was freed during teardown<br /> while its attachment is still live: the exporter then invalidates it via<br /> xe_dma_buf_move_notify() -&gt; xe_bo_evict(), and the switch dereferences a<br /> NULL resource and faults.<br /> <br /> A BO with no resource has nothing placed or mapped, so there is nothing<br /> to evict. Return an empty placement (num_placement = 0), mirroring the<br /> handling already used for non-xe scatter-gather BOs just above;<br /> ttm_bo_validate() then takes the pipeline-gutting path and returns 0.<br /> <br /> Without the fix the xe_dma_buf@xe_test_dmabuf_move_notify_no_resource<br /> dynamic live selftest will fail with below stack.<br /> <br /> BUG: kernel NULL pointer dereference, address: 0000000000000010<br /> RIP: 0010:xe_evict_flags+0xf4/0x140 [xe]<br /> Call Trace:<br /> <br /> xe_bo_evict+0x40/0xa0 [xe]<br /> ? ttm_bo_pipeline_gutting+0x71/0x180 [ttm]<br /> xe_test_dmabuf_move_notify_no_resource+0x182/0x440 [xe]<br /> xe_dma_buf_kunit+0x387/0x580 [xe]<br /> <br /> v2: Add Fixes tag and failure info in commit text (Matt Brost)<br /> <br /> (cherry picked from commit dbcfaac6331f1fcb0c2fe3ad3e9adb1e5d43ec0c)