CVE-2026-68383

Received Received - Intake

Linux Kernel Scheduler Timeline Use-After-Free

Publication date: 2026-08-10

Last updated on: 2026-10-21

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Keep scheduler timeline name alive The scheduler keeps a pointer to the timeline name, but q->name is freed with the exec queue while scheduler fences can still reference it. Store the name in struct xe_guc_exec_queue so it shares the scheduler's RCU-deferred lifetime. (cherry picked from commit 41075f0eb5dcbd3b065d15f15ef7bbe9315188e8)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-10-21

Generated

2026-11-08

AI Q&A

2026-08-10

EPSS Evaluated

2026-11-07

NVD

CVE-2026-68383

EUVD

EUVD-2026-55569

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where the scheduler keeps a pointer to a timeline name that gets freed prematurely. The exec queue's name is freed while scheduler fences may still reference it, potentially causing use-after-free issues.

Detection Guidance

This vulnerability is specific to the Linux kernel's DRM/XE/GuC component and does not have direct network detection methods. It requires kernel-level inspection. Check for kernel logs mentioning xe_guc_exec_queue or scheduler timeline issues using: dmesg | grep xe_guc or journalctl -k | grep xe_guc.

Impact Analysis

This could lead to system instability, crashes, or privilege escalation if exploited. Users running affected Linux kernel versions may experience kernel panics or security breaches.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it pertains to a memory management issue in the Linux kernel's DRM/XE subsystem. Compliance risks would depend on how the affected system is used, not the vulnerability itself.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this issue. Monitor kernel security advisories and apply patches promptly. If using a distribution with delayed updates, consider enabling automatic security updates.

Hi! I’m here to help you understand CVE-2026-68383. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...