Linux kernel drm/xe: imported dma-buf BO can outlive the exporter, giving a use-after-free on the shared resv
Impact
An imported dma-buf buffer object borrows the exporter's reservation object but only takes a dma-buf reference after dma_buf_dynamic_attach() succeeds. If the attach fails, or ttm_bo_init_reserved() fails during creation, the BO still points at the exporter's resv and is torn down asynchronously by ttm_bo_delayed_delete(), which locks that resv possibly after the exporter has been freed - a general protection fault in mutex_can_spin_on_owner() was observed. Buffer sharing across devices and processes is normal on GPU nodes doing peer-to-peer or video/compute interop, so this is reachable by ordinary workloads, and the failure takes down the host.
Who can reach it
Local user able to import a dma-buf into the Xe driver, i.e. any tenant with a GPU pod that uses buffer sharing. Requires hitting an attach or BO-creation failure, which memory pressure makes achievable.
What to do
Apply the stable fix that holds the dma-buf reference for the whole BO lifetime and reboot the node. No configuration mitigation short of blocking dma-buf import, which breaks normal workloads.
References
Related entries
- Linux kernel amdgpu RAS / GPU reset and recovery path (drm/amdgpu): A use-after-free in the amdgpu RAS / GPU reset andCVE-2026-68273 · Linux kernel amdgpu RAS / GPU reset and recovery path (drm/amdgpu)High
- Linux kernel drm/xe GuC: steered register list sized from geometry DSS mask only, overflowing the bufferCVE-2026-68274 · Linux kernel drm/xe GuC steered register list allocationHigh
- Linux kernel drm/xe: SVM state and pagemaps leak on the xe_vm_create() error pathCVE-2026-68298 · Linux kernel drm/xe VM creation (xe_vm_create SVM error unwind)High
- Linux kernel drm/xe VF: NULL dereference detaching CCS buffers after the device is unboundCVE-2026-68305 · Linux kernel drm/xe SR-IOV VF CCS buffer detach (xe_sriov_vf_ccs_detach_bo)High
- Linux kernel drm/xe GuC: async exec queue destruction can deadlock drmm cleanup on device removalCVE-2026-68382 · Linux kernel drm/xe GuC exec queue teardown (device reference lifetime)High
- Linux kernel drm/xe GuC: scheduler keeps a pointer to the exec queue name freed with the queueCVE-2026-68383 · Linux kernel drm/xe GuC submission (scheduler timeline name)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.