Linux kernel dma-buf: use-after-free racing close() against the dma_buf_fd tracepoint

Impact

dma_buf_fd() installs the new file descriptor before emitting its tracepoint. A second thread sharing the file descriptor table can close() that fd in the window, dropping the last reference and freeing the dma_buf, after which the tracepoint dereferences the freed object to take dmabuf->name_lock - a slab use-after-free in kernel memory. dma-buf is the buffer-sharing path every GPU and accelerator driver uses to hand buffers to userspace, so the exporting ioctls are reachable from any process that holds a GPU device node, including a tenant's GPU container. A successful race corrupts kernel slab memory on a GPU node, which means a crash at best and a local escalation primitive at worst, and the node has to be drained and rebooted to recover.

Who can reach it

Local, unprivileged. Any process able to export a dma-buf - that is, anything holding an accelerator or DRM device node such as a GPU pod with /dev/dri or /dev/kfd - can race close() against the fd install from a second thread. No authentication beyond device access is needed. Exposure depends on the dma_buf_fd tracepoint being enabled, since the dereference is in the trace path.

What to do

Patch the kernel to a stable release that splits the fd install back into get_unused_fd_flags() plus fd_install() with the tracepoint emitted between them, then drain and reboot each affected node. Until patched, keeping the dma_buf tracepoints disabled removes the dereference. No vendor advisory beyond the upstream commits.

References

Related entries

• Linux kernel (net/xfrm): Cloning an IPTFS security association kmemdups the mode data, so the clone shares the originalCVE-2026-63911 · Linux kernel (net/xfrm)High
• Linux kernel mm/rmap: stale batch count corrupts folio refcounts on device-exclusive pagesCVE-2026-63950 · Linux kernel mm/rmap (try_to_unmap_one nr_pages batching with device-exclusive PTEs)High
• Linux kernel (net/smc): The SMC socket hashtables are re-initialised at the end of module init, after the protocol andCVE-2026-64005 · Linux kernel (net/smc)High
• Linux kernel (net/xfrm): An unprivileged user who can create IPsec SAs turns one outbound datagram into a multi-exabyteCVE-2026-64009 · Linux kernel (net/xfrm)High
• Linux kernel cgroup/rstat: BPF kfunc accepts an unvalidated CPU index for per-cpu lookupsCVE-2026-64036 · Linux kernel cgroup/rstat (css_rstat_updated BPF kfunc)High
• Linux kernel nvme-pci: use-after-free when Host Memory Buffer setup fails during device probeCVE-2026-64071 · Linux kernel nvme-pci (Host Memory Buffer teardown)High