UBUNTU-CVE-2026-98999: Use After Free
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix stale pinnedlink entry when fb-pin performs the final unpin xebopinexternal() and xebounpinexternal() maintain the bo's pinnedlink list membership in xe->pinned.late.external, based on whether the current call is the outermost pin or the final unpin. However, the same external bo's pincount can also be raised and lowered directly by xepinfbvma()/xeunpinfbvma(), which pin the bo as a display scanout buffer without going through xebopinexternal()/xebounpinexternal() at all, and have no notion of, or ownership over, pinnedlink. If a bo is pinned both externally (e.g. dma-buf export) and as an fb, and the external unpin happens first, xebounpinexternal() correctly observes pincount > 1 and leaves the bo on pinnedlink. When the fb unpin later performs the true last unpin (pincount 1 -> 0), it never touches pinnedlink, leaving the bo linked on xe->pinned.late.external indefinitely. Once the bo is subsequently freed, this stale list entry points into freed memory, corrupting the list and risking a use-after-free the next time the list is walked or spliced. The backup object pin/unpin sites in xebonotifierpreparepinned()/ xebonotifierunpreparepinned() have the same bypass characteristic, though they never add their bo to a pinned list, so are not affected by this particular list-corruption issue. Move the pinnedlink removal into xeboaccountunpin(), which already runs on every unpin path (kernel, external, framebuffer, backup object) right before the true 1 -> 0 pincount transition. Since listdelinit() only operates on the node itself, this removal is list-agnostic and safe to perform regardless of which list (external or kernelbopresent) the bo happens to be linked on, or which code path is performing the final unpin. Drop the now-redundant explicit listdelinit() calls in xebounpinexternal() and xebounpin(). v2: - New patch v3: - Rebased on changes to previous patch. (cherry picked from commit ca58d36a1f93af586ee93b340c9f9fd81312cc01)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.18~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1019.19~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.19~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.18~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-43.43.1~24.04.2 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.3.0-10.10 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.3.0-1004.4 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.3.0-1004.4 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.3.0-1004.5 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.3.0-1004.4 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.3.0-1004.4 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 7.3.0-1004.4 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.3.0-10.10.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.3.0-10.10.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-43.43 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1017.18 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1020.21 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1019.19 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1017.19 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1010.11 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1018.18 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1018.18 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-43.43.1 - Upgrade
Upgrade
Linux kernel drm/xeto a version that resolves this vulnerability.Patch ca58d36a1f93af586ee93b340c9f9fd81312cc01
Event History
Frequently Asked Questions
Which Ubuntu kernel packages are identified as affected?
The advisory identifies ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, ubuntu/linux, and ubuntu/linux-aws. No affected or fixed package versions are provided.
What conditions are required to trigger the stale list entry?
A buffer object must be pinned both externally, such as through dma-buf export, and as a framebuffer scanout buffer. The external unpin must occur before the framebuffer unpin, with the framebuffer unpin performing the final transition of the pin count to zero.
What happens after the triggering pin and unpin sequence?
The buffer object can remain on the external pinned-object list after its final unpin. If it is later freed, the list contains a pointer to freed memory, and a later walk or splice of that list can cause list corruption and a use-after-free.
What level of attacker access is indicated?
The provided severity vector indicates local attack access, low attack complexity, low privileges required, and no user interaction. The vector also rates confidentiality, integrity, and availability impact as high.