UBUNTU-CVE-2026-68380: Use After Free
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix use-after-free of mmstruct in job scheduler amdxdnacmdsubmit() stores current->mm in job->mm without holding any reference. aie2schedjobrun() later access job->mm from the DRM scheduler worker thread. With only a raw pointer and no structural reference, the mmstruct can be freed before the scheduler runs the job. Fix this by calling mmgrab() to hold a structural mmcount reference for the lifetime of the job, paired with mmdrop() in every cleanup path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-nvidia-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1024.25~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-nvidia-bosto a version that resolves this vulnerability.Fixed in 7.0.0-2022.23 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Operational
In amdxdna_cmd_submit(), call mmgrab() to hold a structural mm_count reference for the lifetime of the job, and pair it with mmdrop() in every cleanup path.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The affected software list includes Ubuntu kernel packages linux-riscv, linux-realtime, linux-hwe-edge, linux-azure, linux-gcp, linux-azure-fde, linux-gke, and linux-aws-5.0. Exploitation is local and requires high privileges.
What condition is required to trigger the use-after-free?
A job submission through the AMD XDNA accelerator path must store the submitting task's mm_struct, and the DRM scheduler worker must later run that job after the mm_struct has been freed. The vulnerable behavior occurs because the job retained only a raw pointer rather than a structural reference.
How can I determine whether the installed kernel contains the fix?
Check whether the installed Ubuntu kernel package includes the upstream stable change identified by commit 6875ee2bef48f5d9f045d81a8a4d68893f768a8a. The fix holds an mm_struct reference with mmgrab() for the lifetime of the job and releases it with mmdrop() on cleanup paths.