Linux kernel drm/xe GuC: scheduler keeps a pointer to the exec queue name freed with the queue
Impact
The GPU scheduler holds a pointer to the timeline name, but that string is freed together with the exec queue while scheduler fences can still reference it. Any consumer that reads the fence timeline name - dma-fence debugging, tracing, or sysfs/debugfs fence dumps - can touch freed memory after a queue teardown. Exec queue creation and destruction is driven by ordinary GPU clients, so the free happens on the normal path rather than only in an error case. The record describes a use-after-free read; it does not establish a write primitive.
Who can reach it
Local user with an Xe render node who can create and destroy exec queues. Observation of the stale name requires a path that prints fence timeline names.
What to do
Apply the stable fix that stores the name in struct xe_guc_exec_queue so it shares the scheduler's RCU-deferred lifetime, then reboot the node.
References
Related entries
- Linux kernel drm/xe VF: CCS batch buffers attached/detached without waiting for in-flight BO copyCVE-2026-68384 · Linux kernel drm/xe SR-IOV VF (CCS metadata batch buffers on BO move)High
- Linux kernel vmwgfx: surface array_size taken from userspace without a shader-model boundCVE-2026-68446 · Linux kernel drm/vmwgfx (vmw_surface_metadata::array_size validation)High
- Linux kernel dma-fence: zero-count dedup returns 1, letting amdgpu user-queue waits read an uninitialized fenceCVE-2026-72095 · Linux kernel dma-fence (dma_fence_dedup_array zero-count handling, amdgpu user queues)High
- NVIDIA/Mellanox ConnectX driver (mlx5_ib user access region index release): The driver released the software-side UARCVE-2026-74296 · NVIDIA/Mellanox ConnectX driver (mlx5_ib user access region index release)High
- Linux kernel amdgpu RAS / GPU reset and recovery path (drm/amdgpu): An out-of-bounds access in the amdgpu RAS / GPUCVE-2026-74357 · Linux kernel amdgpu RAS / GPU reset and recovery path (drm/amdgpu)High
- Linux kernel vmwgfx: undersized DRAW_PRIMITIVES header wraps the bound into an out-of-bounds readCVE-2026-74444 · Linux kernel drm/vmwgfx (vmw_cmd_draw DRAW_PRIMITIVES header size)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.