UBUNTU-CVE-2026-98180: Use After Free

In the Linux kernel, the following vulnerability has been resolved: drm/msm: RCU-free the scheduler-containing ring and VM objects Both struct msmringbuffer and struct msmgemvm embed a struct drmgpuscheduler. msmringbufferdestroy() and the VM free callback msmgemvmfree() call drmschedfini() on the embedded scheduler and then free the containing object with plain kfree(). drmschedfencegettimelinename() returns fence->sched->name, and the scheduler fence keeps a .release callback so it is not ops-detached on signalling. A finished fence exported to userspace (the submit out-fence, or a VMBIND fence, via syncfile / drmsyncobj) keeps pointing at the embedded scheduler after the ring/VM is freed, so a later gettimelinename() -- reachable unprivileged through SYNCIOCFILEINFO -- dereferences freed slab memory (KASAN slab-use-after-free read). Per the dma-fence lifetime contract the exporter must keep the data backing a signalled fence alive for an RCU grace period. Free the scheduler-containing objects with kfreercu() instead of kfree(). Patchwork: https://patchwork.freedesktop.org/patch/750234/