UBUNTU-CVE-2026-98512: Use After Free

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: RCU-free the scheduler-containing nouveausched struct nouveausched embeds a struct drmgpuscheduler (base). nouveauscheddestroy() calls nouveauschedfini() (which does drmschedfini(&sched->base)) and then frees the object with plain kfree(sched). drmschedfencegettimelinename() returns fence->sched->name, and the scheduler fence keeps a .release callback so it is not ops-detached on signalling. A finished fence exported to userspace via drmsyncobj / syncfile therefore keeps pointing at &sched->base after nouveauscheddestroy(), and a later gettimelinename() -- reachable unprivileged through SYNCIOCFILEINFO -- dereferences freed memory (KASAN slab-use-after-free read). Per the dma-fence lifetime contract the exporter must keep the data backing a signalled fence alive for an RCU grace period. Free the scheduler-containing object with kfreercu() instead of kfree().