Linux kernel (drivers/gpu/drm/xe): Freeing a scheduler job dereferences the VM it belongs to, but the final exec-queue

Impact

Freeing a scheduler job dereferences the VM it belongs to, but the final exec-queue put that happens first can already have destroyed that VM. The result is a use-after-free on the scheduler job path, reachable from an ordinary submit-then-close sequence inside a tenant container.

Who can reach it

Tenant holding /dev/dri/renderD* on Intel xe: submit jobs, then destroy the exec queue and VM so the last reference drops while jobs are still being freed. Unprivileged; the ordering is under the tenant's control.

What to do

Update to a kernel carrying the fix (stable commits below; no fixed_in published). No interim control - this is the standard submission teardown path.

References