CVE-2026-98180 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/msm: RCU-free the scheduler-containing ring and VM objects
Both struct msm_ringbuffer and struct msm_gem_vm embed a struct drm_gpu_scheduler. msm_ringbuffer_destroy() and the VM free callback msm_gem_vm_free() call drm_sched_fini() on the embedded scheduler and then free the containing object with plain kfree().
drm_sched_fence_get_timeline_name() returns fence->sched->name, and the scheduler fence keeps a .release callback so it is not ops-detached on signalling. A finished fence exported to userspace (the submit out-fence, or a VM_BIND fence, via sync_file / drm_syncobj) keeps pointing at the embedded scheduler after the ring/VM is freed, so a later get_timeline_name() -- reachable unprivileged through SYNC_IOC_FILE_INFO -- dereferences freed slab memory (KASAN slab-use-after-free read).
Per the dma-fence lifetime contract the exporter must keep the data backing a signalled fence alive for an RCU grace period. Free the scheduler-containing objects with kfree_rcu() instead of kfree().
Patchwork: https://patchwork.freedesktop.org/patch/750234/
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The Linux kernel vulnerability identified in the drm/msm subsystem involves a critical use-after-free condition affecting memory management for GPU scheduler objects. Specifically, the structures msm_ringbuffer and msm_gem_vm embed an instance of struct drm_gpu_scheduler. The core flaw lies in how these containing objects are destroyed. When either msm_ringbuffer_destroy or the VM free callback msm_gem_vm_free is invoked, the code calls drm_sched_fini to tear down the embedded scheduler and subsequently frees the entire object using standard kfree. This sequence assumes that no external references to the freed memory remain active after the deallocation occurs. However, this assumption violates the dma-fence lifetime contract established within the kernel's synchronization infrastructure.
The operational impact stems from how fence objects interact with userspace applications. The function drm_sched_fence_get_timeline_name retrieves a pointer to the scheduler name via fence->sched->name. Because the scheduler fence maintains a release callback that prevents it from being ops-detached upon signaling, the fence object retains a reference to the embedded scheduler even after the ringbuffer or VM structure has been logically destroyed and its memory returned to the slab allocator for reuse. When such a finished fence is exported to userspace through mechanisms like sync_file or drm_syncobj, specifically as an out-fence during submission or a VM_BIND fence, it continues to hold this stale pointer.
This leads directly to a kernel address sanitizer (KASAN) detected slab-use-after-free read condition. An unprivileged user can trigger the vulnerability by invoking SYNC_IOC_FILE_INFO on the exported sync file object. This ioctl calls get_timeline_name, which attempts to dereference the scheduler name from the fence structure. Since the underlying memory containing that scheduler has already been freed and potentially reallocated for other purposes, this access results in reading arbitrary kernel memory or causing a crash due to invalid pointer dereferencing. The vulnerability effectively allows local privilege escalation or denial of service depending on whether sensitive data is leaked or if the system panics during the fault handling process.
From a classification perspective, this flaw aligns with CWE-416 Use After Free and falls under MITRE ATT&CK technique T1059 Command and Scripting Interpreter via ioctl abuse for local exploitation vectors. The root cause is a failure to adhere to RCU (Read-Copy-Update) semantics required by the dma-fence subsystem. According to these standards, any data backing a signalled fence must remain valid for at least one full RCU grace period after it becomes signaled. This ensures that all concurrent readers have completed their access before the memory is reclaimed.
The remediation strategy implemented in the patch addresses this lifecycle mismatch by replacing kfree with kfree_rcu when freeing the scheduler-containing objects. By utilizing kfree_rcu, the kernel schedules the actual deallocation to occur only after a complete RCU grace period has elapsed. This guarantees that any pending reads initiated through userspace ioctl calls will have finished before the memory is returned to the slab allocator. This change ensures compliance with the dma-fence lifetime contract and eliminates the window of opportunity for use-after-free exploitation, thereby restoring system stability and security integrity for mobile GPU drivers utilizing this subsystem.