Most recent entries from all

CVE-2025-40096 — drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies

2026-10-07T23:23:01.657615+00:00

Affected: Linux

In the Linux kernel, the following vulnerability has been resolved:

drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies

When adding dependencies with drm_sched_job_add_dependency(), that function consumes the fence reference both on success and failure, so in the latter case the dma_fence_put() on the error path (xarray failed to expand) is a double free.

Interestingly this bug appears to have been present ever since commit ebd5f74255b9 ("drm/sched: Add dependency tracking"), since the code back then looked like this:

drm_sched_job_add_implicit_dependencies(): ... for (i = 0; i < fence_count; i++) { ret = drm_sched_job_add_dependency(job, fences[i]); if (ret) break; }

for (; i < fence_count; i++) dma_fence_put(fences[i]);

Which means for the failing 'i' the dma_fence_put was already a double free. Possibly there were no users at that time, or the test cases were insufficient to hit it.

The bug was then only noticed and fixed after commit 9c2ba265352a ("drm/scheduler: use new iterator in drm_sched_job_add_implicit_dependencies v2") landed, with its fixup of commit 4eaf02d6076c ("drm/scheduler: fix drm_sched_job_add_implicit_dependencies").

At that point it was a slightly different flavour of a double free, which commit 963d0b356935 ("drm/scheduler: fix drm_sched_job_add_implicit_dependencies harder") noticed and attempted to fix.

But it only moved the doub…

RHSA-2026:0759 — Red Hat Security Advisory: kernel security update

2026-10-07T23:23:01.657708+00:00

kernel: drm/i915: mark requests for GuC virtual engines to avoid use-after-free kernel: smb: client: Fix use-after-free in cifs_fill_dirent kernel: smb: client: let recv_done verify data_offset, data_length and remaining_data_length kernel: drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies kernel: net: atlantic: fix fragment overflow handling in RX path

RHSA-2026:0760 — Red Hat Security Advisory: kernel-rt security update

2026-10-07T23:23:01.657740+00:00