SB20260626206 - NULL pointer dereference in Linux kernel xe display driver

Description

This security bulletin contains information about 1 vulnerability.

1) NULL pointer dereference (CVE-ID: CVE-2026-53142)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the xe display initialization and cleanup logic when handling suspend or shutdown on systems without display hardware present. A local user can trigger suspend or shutdown processing to cause a denial of service.

The issue occurs when display support is probed but display hardware is later determined to be unavailable or disabled at runtime initialization.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/0f68ddfaaebfbb5581ee931779757d31f4dc9e24
• https://git.kernel.org/stable/c/238bcdaae8f2abc65e182de7d1f69cf8f611a610
• https://git.kernel.org/stable/c/68938cc08e23a94fd881e845837ff918de005ce7