Linux kernel (drivers/gpu/drm): The shared shmem GEM mmap helper dropped a reference it never owned, so the buffer

Impact

The shared shmem GEM mmap helper dropped a reference it never owned, so the buffer object is freed while still mapped and still referenced - a use-after-free on a GEM object that the tenant continues to hold a mapping to. This is a strong exploitation primitive: the tenant keeps a live mapping over freed kernel-managed pages.

Who can reach it

A tenant process holding /dev/dri/renderD* on any driver built on the shmem GEM helpers (virtio-gpu and the shmem-backed DRM drivers) triggers it by mmap'ing a GEM object and forcing the helper's error path. Unprivileged, render-node only.

What to do

Boot a kernel carrying the drm_gem_shmem_helper fix below. Interim: remove /dev/dri/renderD* from untrusted containers on nodes whose DRM driver uses the shmem helpers.

References