CVE-2026-98180: drm/msm: RCU-free the scheduler-containing ring and VM objects
drm/msm: RCU-free the scheduler-containing ring and VM objects
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Change msm_ringbuffer_destroy() and msm_gem_vm_free() to free the scheduler-containing struct msm_ringbuffer and struct msm_gem_vm objects with kfree_rcu() instead of kfree(), after calling drm_sched_fini() on the embedded drm_gpu_scheduler.
Event History
Frequently Asked Questions
Who can trigger the use-after-free condition?
An unprivileged local user can reach the affected timeline-name lookup through SYNC_IOC_FILE_INFO, provided they hold an exported completed fence from an MSM submit out-fence or VM_BIND operation via sync_file or drm_syncobj.
What condition is required for exploitation?
The ringbuffer or VM containing the embedded GPU scheduler must be destroyed after a fence has been exported to userspace. A later timeline-name query on that completed fence can then dereference the freed scheduler memory.
What does the fix change?
The fix frees the scheduler-containing ringbuffer and VM objects with kfree_rcu() rather than kfree(). This preserves the backing scheduler data for the required RCU grace period after a signalled fence is released.