CVE-2026-98180 (GCVE-0-2026-98180)

Vulnerability from cvelistv5 – Published: 2026-10-06 08:44 – Updated: 2026-10-07 06:49
VLAI
Title
drm/msm: RCU-free the scheduler-containing ring and VM objects
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/msm: RCU-free the scheduler-containing ring and VM objects Both struct msm_ringbuffer and struct msm_gem_vm embed a struct drm_gpu_scheduler. msm_ringbuffer_destroy() and the VM free callback msm_gem_vm_free() call drm_sched_fini() on the embedded scheduler and then free the containing object with plain kfree(). drm_sched_fence_get_timeline_name() returns fence->sched->name, and the scheduler fence keeps a .release callback so it is not ops-detached on signalling. A finished fence exported to userspace (the submit out-fence, or a VM_BIND fence, via sync_file / drm_syncobj) keeps pointing at the embedded scheduler after the ring/VM is freed, so a later get_timeline_name() -- reachable unprivileged through SYNC_IOC_FILE_INFO -- dereferences freed slab memory (KASAN slab-use-after-free read). Per the dma-fence lifetime contract the exporter must keep the data backing a signalled fence alive for an RCU grace period. Free the scheduler-containing objects with kfree_rcu() instead of kfree(). Patchwork: https://patchwork.freedesktop.org/patch/750234/
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 1d8a5ca436ee4a28eec14cb813f790f7cdeeee19 , < d81bf4581903b0cba0698cd4d1c07fc6be21754a (git)
Affected: 1d8a5ca436ee4a28eec14cb813f790f7cdeeee19 , < 713abac5c04ccbae67f9ac68c3921845535388e7 (git)
Affected: 1d8a5ca436ee4a28eec14cb813f790f7cdeeee19 , < 01c8d1f385f788f1bbbbb7687c4386d614281218 (git)
Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 6.18.54 , ≤ 6.18.* (semver)
Unaffected: 7.2.8 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/msm/msm_gem.h",
            "drivers/gpu/drm/msm/msm_gem_vma.c",
            "drivers/gpu/drm/msm/msm_ringbuffer.c",
            "drivers/gpu/drm/msm/msm_ringbuffer.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d81bf4581903b0cba0698cd4d1c07fc6be21754a",
              "status": "affected",
              "version": "1d8a5ca436ee4a28eec14cb813f790f7cdeeee19",
              "versionType": "git"
            },
            {
              "lessThan": "713abac5c04ccbae67f9ac68c3921845535388e7",
              "status": "affected",
              "version": "1d8a5ca436ee4a28eec14cb813f790f7cdeeee19",
              "versionType": "git"
            },
            {
              "lessThan": "01c8d1f385f788f1bbbbb7687c4386d614281218",
              "status": "affected",
              "version": "1d8a5ca436ee4a28eec14cb813f790f7cdeeee19",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/msm/msm_gem.h",
            "drivers/gpu/drm/msm/msm_gem_vma.c",
            "drivers/gpu/drm/msm/msm_ringbuffer.c",
            "drivers/gpu/drm/msm/msm_ringbuffer.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.54",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.8",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc4",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm: RCU-free the scheduler-containing ring and VM objects\n\nBoth struct msm_ringbuffer and struct msm_gem_vm embed a struct\ndrm_gpu_scheduler.  msm_ringbuffer_destroy() and the VM free callback\nmsm_gem_vm_free() call drm_sched_fini() on the embedded scheduler and then\nfree the containing object with plain kfree().\n\ndrm_sched_fence_get_timeline_name() returns fence-\u003esched-\u003ename, and the\nscheduler fence keeps a .release callback so it is not ops-detached on\nsignalling.  A finished fence exported to userspace (the submit out-fence, or\na VM_BIND fence, via sync_file / drm_syncobj) keeps pointing at the embedded\nscheduler after the ring/VM is freed, so a later get_timeline_name() --\nreachable unprivileged through SYNC_IOC_FILE_INFO -- dereferences freed slab\nmemory (KASAN slab-use-after-free read).\n\nPer the dma-fence lifetime contract the exporter must keep the data backing a\nsignalled fence alive for an RCU grace period.  Free the scheduler-containing\nobjects with kfree_rcu() instead of kfree().\n\nPatchwork: https://patchwork.freedesktop.org/patch/750234/"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The freed memory is reached by a local process through render-node ioctls (MSM_SET_PARAM to enable VM_BIND, MSM_VM_BIND/MSM_GEM_SUBMIT with an out-fence) followed by SYNC_IOC_FILE_INFO on the exported sync_file. No remote data is involved.\nAC:L - The attacker runs every step: create a user-managed VM, submit a VM_BIND job with an out-fence fd, close the DRM fd so msm_gem_vm_close()/msm_gem_vm_free() kfree the VM, then query the sync_file. They choose when the free happens, so there is no race they can\u0027t control.\nPR:L - All msm ioctls used are DRM_RENDER_ALLOW and the sync_file ioctl needs only the fd. An unprivileged user with render-node access (render group, or any Android app with GPU access) can do this without capabilities.\nUI:N - No victim action is needed. The attacker creates and frees the VM and queries the fence entirely through their own file descriptors.\nS:U - This is a use-after-free in the kernel\u0027s own memory with impact inside the same kernel authority. No VM, IOMMU or sandbox boundary is crossed.\nC:H - drm_sched_fence_get_timeline_name() returns fence-\u003esched-\u003ename from the freed msm_gem_vm. If the slab is refilled with attacker data, that name pointer is attacker-controlled, and sync_fill_fence_info() strscpy()s up to 32 bytes from that address into obj_name returned to userspace. That is a repeatable arbitrary kernel read.\nI:N - Nothing writes through the stale fence-\u003esched: get_timeline_name only reads it and sched_entity.c only compares the pointer. The freed scheduler gives a read primitive, not a write or control-flow primitive.\nA:H - Dereferencing freed or reclaimed memory and strscpy() from a bad name pointer causes a kernel oops/panic (KASAN slab-use-after-free read), which the attacker can trigger repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-07T06:49:28.231Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d81bf4581903b0cba0698cd4d1c07fc6be21754a"
        },
        {
          "url": "https://git.kernel.org/stable/c/713abac5c04ccbae67f9ac68c3921845535388e7"
        },
        {
          "url": "https://git.kernel.org/stable/c/01c8d1f385f788f1bbbbb7687c4386d614281218"
        }
      ],
      "title": "drm/msm: RCU-free the scheduler-containing ring and VM objects",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98180",
    "datePublished": "2026-10-06T08:44:23.327Z",
    "dateReserved": "2026-09-25T10:25:14.322Z",
    "dateUpdated": "2026-10-07T06:49:28.231Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-98180",
      "date": "2026-10-08",
      "epss": "0.0012",
      "percentile": "0.01672"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/msm/msm_gem.h",
                  "drivers/gpu/drm/msm/msm_gem_vma.c",
                  "drivers/gpu/drm/msm/msm_ringbuffer.c",
                  "drivers/gpu/drm/msm/msm_ringbuffer.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "d81bf4581903b0cba0698cd4d1c07fc6be21754a",
                    "status": "affected",
                    "version": "1d8a5ca436ee4a28eec14cb813f790f7cdeeee19",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "713abac5c04ccbae67f9ac68c3921845535388e7",
                    "status": "affected",
                    "version": "1d8a5ca436ee4a28eec14cb813f790f7cdeeee19",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "01c8d1f385f788f1bbbbb7687c4386d614281218",
                    "status": "affected",
                    "version": "1d8a5ca436ee4a28eec14cb813f790f7cdeeee19",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/msm/msm_gem.h",
                  "drivers/gpu/drm/msm/msm_gem_vma.c",
                  "drivers/gpu/drm/msm/msm_ringbuffer.c",
                  "drivers/gpu/drm/msm/msm_ringbuffer.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.15"
                  },
                  {
                    "lessThan": "5.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.54",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc4",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm: RCU-free the scheduler-containing ring and VM objects\n\nBoth struct msm_ringbuffer and struct msm_gem_vm embed a struct\ndrm_gpu_scheduler.  msm_ringbuffer_destroy() and the VM free callback\nmsm_gem_vm_free() call drm_sched_fini() on the embedded scheduler and then\nfree the containing object with plain kfree().\n\ndrm_sched_fence_get_timeline_name() returns fence-\u003esched-\u003ename, and the\nscheduler fence keeps a .release callback so it is not ops-detached on\nsignalling.  A finished fence exported to userspace (the submit out-fence, or\na VM_BIND fence, via sync_file / drm_syncobj) keeps pointing at the embedded\nscheduler after the ring/VM is freed, so a later get_timeline_name() --\nreachable unprivileged through SYNC_IOC_FILE_INFO -- dereferences freed slab\nmemory (KASAN slab-use-after-free read).\n\nPer the dma-fence lifetime contract the exporter must keep the data backing a\nsignalled fence alive for an RCU grace period.  Free the scheduler-containing\nobjects with kfree_rcu() instead of kfree().\n\nPatchwork: https://patchwork.freedesktop.org/patch/750234/"
          }
        ],
        "id": "CVE-2026-98180",
        "lastModified": "2026-10-07T07:17:04.363",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-10-06T09:18:01.617",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/01c8d1f385f788f1bbbbb7687c4386d614281218"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/713abac5c04ccbae67f9ac68c3921845535388e7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d81bf4581903b0cba0698cd4d1c07fc6be21754a"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-10-08T14:23:24+00:00",
      "cve": "CVE-2026-98180",
      "id": "CVE-2026-98180",
      "initial_release_date": "2026-10-06T00:00:00+00:00",
      "product_status:known_not_affected": "277",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/msm: RCU-free the scheduler-containing ring and VM objects",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98180.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-10-08T16:51:24Z",
      "cve": "CVE-2026-98180",
      "id": "CVE-2026-98180",
      "initial_release_date": "2026-10-08T16:51:24Z",
      "product_status:known_affected": "108",
      "product_status:known_not_affected": "239",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-98180",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-98180.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.