SB20260812271 - Use-after-free in Linux kernel drm xe driver

Description

This security bulletin contains information about 1 vulnerability.

1) Use-after-free (CVE-ID: CVE-2026-68266)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the xe dma-buf imported buffer object handling when tearing down imported buffer objects after dma_buf_dynamic_attach() or buffer object creation fails. A local user can trigger creation of a crafted imported dma-buf buffer object to cause a denial of service.

The issue can be reached on failure paths where the buffer object already references the exporter's reservation object and that reservation object is later accessed asynchronously during delayed deletion.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/62775525a27c3b0d56382e08ba81ee2d322058b6
• https://git.kernel.org/stable/c/ba8c4cbb31c6f81fa5b12d6e28f1f706040aff48
• https://git.kernel.org/stable/c/c1954c66662de477a8f4309335b775f7b07bd28b
• https://git.kernel.org/stable/c/c22d65d62b3318e237c0e5b1177d90ab83d9fe06