Use-after-free in Linux kernel - CVE-2026-68266

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the xe dma-buf imported buffer object handling when tearing down imported buffer objects after dma_buf_dynamic_attach() or buffer object creation fails. A local user can trigger creation of a crafted imported dma-buf buffer object to cause a denial of service.

The issue can be reached on failure paths where the buffer object already references the exporter's reservation object and that reservation object is later accessed asynchronously during delayed deletion.

Affected software

How to mitigate CVE-2026-68266

External References

• https://git.kernel.org/stable/c/62775525a27c3b0d56382e08ba81ee2d322058b6
• https://git.kernel.org/stable/c/ba8c4cbb31c6f81fa5b12d6e28f1f706040aff48
• https://git.kernel.org/stable/c/c1954c66662de477a8f4309335b775f7b07bd28b
• https://git.kernel.org/stable/c/c22d65d62b3318e237c0e5b1177d90ab83d9fe06

Related Security Bulletins

• Use-after-free in Linux kernel drm xe driver
• Debian update for linux
• Red Hat Enterprise Linux 9 update for kernel