Linux kernel (drivers/gpu/drm): The dma_buf pointer cached on a GEM object goes stale the moment userspace drops the

Impact

The dma_buf pointer cached on a GEM object goes stale the moment userspace drops the last handle on that buffer, so a tenant that closes a handle at the right time while a PRIME export or import path is still walking the object gets the kernel to follow a dead pointer. The result is a kernel oops in shared DRM core code - code every driver on the node runs, not just one vendor's.

Who can reach it

A tenant container holding /dev/dri/renderD* drives it entirely with buffer-sharing ioctls: export a GEM object to a dma-buf fd, then release the last GEM handle while another thread is still operating on the shared buffer. No display access, no privileged capability, and the affected file is drm_prime.c in DRM core, so amdgpu, i915, xe, nouveau and virtio-gpu nodes are all in scope.

What to do

Update to a kernel containing the revert commits below. There is no useful interim control other than denying /dev/dri access to untrusted workloads, since PRIME buffer sharing is used by essentially every GPU client.

References