CVE-2026-98180 - Vulnerability Details

- drm/msm: RCU-free the scheduler-containing ring and VM objects

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/msm: RCU-free the scheduler-containing ring and VM objects

Both struct msm_ringbuffer and struct msm_gem_vm embed a struct
drm_gpu_scheduler. msm_ringbuffer_destroy() and the VM free callback
msm_gem_vm_free() call drm_sched_fini() on the embedded scheduler and then
free the containing object with plain kfree().

drm_sched_fence_get_timeline_name() returns fence->sched->name, and the
scheduler fence keeps a .release callback so it is not ops-detached on
signalling. A finished fence exported to userspace (the submit out-fence, or
a VM_BIND fence, via sync_file / drm_syncobj) keeps pointing at the embedded
scheduler after the ring/VM is freed, so a later get_timeline_name() --
reachable unprivileged through SYNC_IOC_FILE_INFO -- dereferences freed slab
memory (KASAN slab-use-after-free read).

Per the dma-fence lifetime contract the exporter must keep the data backing a
signalled fence alive for an RCU grace period. Free the scheduler-containing
objects with kfree_rcu() instead of kfree().

Patchwork: https://patchwork.freedesktop.org/patch/750234/

Published: 2026-10-06

Score: 7.1 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel contains a use‑after‑free vulnerability in the msm DRM driver. The driver frees scheduler‑containing ring buffers or VM objects with a plain kfree() instead of kfree_rcu(). When a fence that references the embedded scheduler is still in use, a later call to drm_sched_fence_get_timeline_name() dereferences freed slab memory, allowing an attacker to read or corrupt sensitive kernel data.

Affected Systems

All systems running a Linux kernel that includes the drm/msm component are affected. No specific kernel version range is listed, but the problem is fixed in recent releases by replacing kfree() with kfree_rcu() in msm_ringbuffer_destroy() and msm_gem_vm_free().

Risk and Exploitability

The attacker only needs local unprivileged access and can trigger the flaw by sending a SYNC_IOC_FILE_INFO ioctl with a fence exported via sync_file or drm_syncobj. The EPSS score is less than 1%, and the vulnerability is not in CISA KEV, but the CVSS score of 7.1 and the possibility of kernel memory corruption suggest a high risk of privilege escalation or denial of service if exploited.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1d8a5ca436ee4a28eec14cb813f790f7cdeeee19`	affected	< d81bf4581903b0cba0698cd4d1c07fc6be21754a
`1d8a5ca436ee4a28eec14cb813f790f7cdeeee19`	affected	< 713abac5c04ccbae67f9ac68c3921845535388e7
`1d8a5ca436ee4a28eec14cb813f790f7cdeeee19`	affected	< 01c8d1f385f788f1bbbbb7687c4386d614281218

Linux

affected

Version	Status	Constraints
`5.15`	affected	—
`0`	unaffected	< 5.15
`6.18.54`	unaffected	≤ 6.18.*
`7.2.8`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1d8a5ca436ee4a28eec14cb813f790f7cdeeee19,d81bf4581903b0cba0698cd4d1c07fc6be21754a)`	affected	code_commit	—
`[1d8a5ca436ee4a28eec14cb813f790f7cdeeee19,713abac5c04ccbae67f9ac68c3921845535388e7)`	affected	code_commit	—
`[1d8a5ca436ee4a28eec14cb813f790f7cdeeee19,01c8d1f385f788f1bbbbb7687c4386d614281218)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.15`	affected	generic	—
`[0,5.15)`	unaffected	semver	—
`[6.18.54,6.19.0)`	unaffected	semver	—
`[7.2.8,7.3.0)`	unaffected	semver	—
`[7.3-rc4,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the kernel to a version that contains the kfree_rcu patch for msm_ringbuffer_destroy() and msm_gem_vm_free(); for example, install updates that include commit 01c8d1f or later.
If the required update is not available in your distribution, backport the kfree_rcu change from the referenced commit into your kernel source tree and rebuild the kernel.
Apply device permission restrictions or udev rules to limit unprivileged access to DRM sync objects, reducing the likelihood of an attacker invoking the vulnerable SYNC_IOC_FILE_INFO ioctl.

Generated by OpenCVE AI on October 9, 2026 at 04:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00121.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98180.mbox
https://git.kernel.org/stable/c/01c8d1f385f788f1bbbbb7687c4386d614281218
https://git.kernel.org/stable/c/713abac5c04ccbae67f9ac68c3921845535388e7
https://git.kernel.org/stable/c/d81bf4581903b0cba0698cd4d1c07fc6be21754a
https://nvd.nist.gov/vuln/detail/CVE-2026-98180
https://www.cve.org/CVERecord?id=CVE-2026-98180

History

Fri, 09 Oct 2026 03:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Fri, 09 Oct 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98180.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98180 https://www.cve.org/CVERecord?id=CVE-2026-98180
Metrics	threat_severity `None`	threat_severity `Moderate`

Wed, 07 Oct 2026 11:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Wed, 07 Oct 2026 09:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Wed, 07 Oct 2026 07:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H'}`

Wed, 07 Oct 2026 05:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Tue, 06 Oct 2026 09:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: drm/msm: RCU-free the scheduler-containing ring and VM objects Both struct msm_ringbuffer and struct msm_gem_vm embed a struct drm_gpu_scheduler. msm_ringbuffer_destroy() and the VM free callback msm_gem_vm_free() call drm_sched_fini() on the embedded scheduler and then free the containing object with plain kfree(). drm_sched_fence_get_timeline_name() returns fence->sched->name, and the scheduler fence keeps a .release callback so it is not ops-detached on signalling. A finished fence exported to userspace (the submit out-fence, or a VM_BIND fence, via sync_file / drm_syncobj) keeps pointing at the embedded scheduler after the ring/VM is freed, so a later get_timeline_name() -- reachable unprivileged through SYNC_IOC_FILE_INFO -- dereferences freed slab memory (KASAN slab-use-after-free read). Per the dma-fence lifetime contract the exporter must keep the data backing a signalled fence alive for an RCU grace period. Free the scheduler-containing objects with kfree_rcu() instead of kfree(). Patchwork: https://patchwork.freedesktop.org/patch/750234/
Title		drm/msm: RCU-free the scheduler-containing ring and VM objects
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/01c8d1f385f788f1bbbbb7687c4386d614281218 https://git.kernel.org/stable/c/713abac5c04ccbae67f9ac68c3921845535388e7 https://git.kernel.org/stable/c/d81bf4581903b0cba0698cd4d1c07fc6be21754a

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-06T08:44:23.327Z

Updated: 2026-10-19T09:15:11.540Z

Reserved: 2026-09-25T10:25:14.322Z

Link: CVE-2026-98180

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-06T09:18:01.617

Modified: 2026-10-19T10:18:18.327

Link: CVE-2026-98180

Redhat

Severity : Moderate

Publid Date: 2026-10-06T00:00:00Z

Links: CVE-2026-98180 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-09T05:00:14Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object