CVE-2026-68266

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

drm/xe: Hold a dma-buf reference for imported BOs

An imported dma-buf BO is created as a ttm_bo_type_sg BO whose

reservation object is the exporter's dma_buf->resv. The importer,

however, only takes a dma-buf reference after a successful

dma_buf_dynamic_attach(). Until then nothing keeps the exporter alive,

so if the exporter is freed while the BO still references its resv, a

later access to that resv is a use-after-free:

Oops: general protection fault, probably for non-canonical address

0x6b6b6b6b6b6b6b9c

Workqueue: ttm ttm_bo_delayed_delete [ttm]

RIP: 0010:mutex_can_spin_on_owner+0x3f/0xc0

This can be reached on two paths:

- dma_buf_dynamic_attach() fails, or

- ttm_bo_init_reserved() fails during BO creation.

In both cases the BO already has bo->base.resv pointing at the exporter

resv, and sg BOs are always torn down via ttm_bo_delayed_delete(), which

locks bo->base.resv asynchronously - potenti

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References