CVE-2026-98180

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/msm: RCU-free the scheduler-containing ring and VM objects

Both struct msm_ringbuffer and struct msm_gem_vm embed a struct

drm_gpu_scheduler. msm_ringbuffer_destroy() and the VM free callback

msm_gem_vm_free() call drm_sched_fini() on the embedded scheduler and then

free the containing object with plain kfree().

drm_sched_fence_get_timeline_name() returns fence->sched->name, and the

scheduler fence keeps a .release callback so it is not ops-detached on

signalling. A finished fence exported to userspace (the submit out-fence, or

a VM_BIND fence, via sync_file / drm_syncobj) keeps pointing at the embedded

scheduler after the ring/VM is freed, so a later get_timeline_name() --

reachable unprivileged through SYNC_IOC_FILE_INFO -- dereferences freed slab

memory (KASAN slab-use-after-free read).

Per the dma-fence lifetime contract the exporter must keep the data backing a

signalled fence alive for an RCU grace peri

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References