---
id: CVE-2026-99209
title: 'drm/xe: skip eviction of a BO with no resource'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/xe: skip eviction of a BO with no resource

  xe_evict_flags() switches on tbo->resource->mem_type to choose an
  eviction placement. An xe BO can reach eviction with n…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= dd08ebf6c3525a7ea2186e636df064ea47281987 <
    6046bb9cb2859e3d9bf939e4d6527f3827e1096f
  - >-
    Linux >= dd08ebf6c3525a7ea2186e636df064ea47281987 <
    b6499d19ade1f1e4a1e6b739abc8c815297c98b8
  - >-
    Linux >= dd08ebf6c3525a7ea2186e636df064ea47281987 <
    448e76cbdc6652ccd3ba337b7a6e1f028859f2ed
  - Linux 6.8
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T10:36:03.274Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99209'
references:
  - url: 'https://git.kernel.org/stable/c/6046bb9cb2859e3d9bf939e4d6527f3827e1096f'
  - url: 'https://git.kernel.org/stable/c/b6499d19ade1f1e4a1e6b739abc8c815297c98b8'
  - url: 'https://git.kernel.org/stable/c/448e76cbdc6652ccd3ba337b7a6e1f028859f2ed'
tags:
  - cve.org
ingestedAt: '2026-10-28T11:09:40.358Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/xe: skip eviction of a BO with no resource

xe_evict_flags() switches on tbo->resource->mem_type to choose an
eviction placement. An xe BO can reach eviction with no ttm.resource,
e.g. an imported dma-buf BO whose resource was freed during teardown
while its attachment is still live: the exporter then invalidates it via
xe_dma_buf_move_notify() -> xe_bo_evict(), and the switch dereferences a
NULL resource and faults.

A BO with no resource has nothing placed or mapped, so there is nothing
to evict. Return an empty placement (num_placement = 0), mirroring the
handling already used for non-xe scatter-gather BOs just above;
ttm_bo_validate() then takes the pipeline-gutting path and returns 0.

Without the fix the xe_dma_buf@xe_test_dmabuf_move_notify_no_resource
dynamic live selftest will fail with below stack.

BUG: kernel NULL pointer dereference, address: 0000000000000010
RIP: 0010:xe_evict_flags+0xf4/0x140 [xe]
Call Trace:
 <TASK>
 xe_bo_evict+0x40/0xa0 [xe]
 ? ttm_bo_pipeline_gutting+0x71/0x180 [ttm]
 xe_test_dmabuf_move_notify_no_resource+0x182/0x440 [xe]
 xe_dma_buf_kunit+0x387/0x580 [xe]

v2: Add Fixes tag and failure info in commit text (Matt Brost)

(cherry picked from commit dbcfaac6331f1fcb0c2fe3ad3e9adb1e5d43ec0c)

## Affected

- `Linux >= dd08ebf6c3525a7ea2186e636df064ea47281987 < 6046bb9cb2859e3d9bf939e4d6527f3827e1096f`
- `Linux >= dd08ebf6c3525a7ea2186e636df064ea47281987 < b6499d19ade1f1e4a1e6b739abc8c815297c98b8`
- `Linux >= dd08ebf6c3525a7ea2186e636df064ea47281987 < 448e76cbdc6652ccd3ba337b7a6e1f028859f2ed`
- `Linux 6.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.