CVE-2026-98180

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: drm/msm: RCU-free the scheduler-containing ring and VM objects Both struct msm_ringbuffer and struct msm_gem_vm embed a struct drm_gpu_scheduler. msm_ringbuffer_destroy() and the VM free callback msm_gem_vm_free() call drm_sched_fini() on the embedded scheduler and then free the containing object with plain kfree(). drm_sched_fence_get_timeline_name() returns fence->sched->name, and the scheduler fence keeps a .release callback so it is not ops-detached on signalling. A finished fence exported to userspace (the submit out-fence, or a VM_BIND fence, via sync_file / drm_syncobj) keeps pointing at the embedded scheduler after the ring/VM is freed, so a later get_timeline_name() -- reachable unprivileged through SYNC_IOC_FILE_INFO -- dereferences freed slab memory (KASAN slab-use-after-free read). Per the dma-fence lifetime contract the exporter must keep the data backing a signalled fence alive for an RCU grace period. Free the scheduler-containing objects with kfree_rcu() instead of kfree(). Patchwork: https://patchwork.freedesktop.org/patch/750234/

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98180

EUVD

EUVD-2026-93108

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	1d8a5ca436ee4a28eec14cb813f790f7cdeeee19
Linux	Linux	1d8a5ca436ee4a28eec14cb813f790f7cdeeee19
Linux	Linux	1d8a5ca436ee4a28eec14cb813f790f7cdeeee19
Linux	Linux	5.15

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's drm/msm driver. It occurs when freed memory containing a GPU scheduler is still referenced by a fence object exported to userspace. The scheduler's name is accessed later through a syscall, causing a slab-use-after-free read.

Detection Guidance

This vulnerability is specific to the Linux kernel's DRM subsystem and requires kernel-level detection. It involves a use-after-free issue in the msm driver related to GPU scheduler and ring/VM objects. Detection would typically involve checking kernel logs for related errors or using kernel debugging tools like KASAN if enabled. No direct network detection commands are applicable.

Impact Analysis

An attacker with local access could exploit this to read sensitive kernel memory, potentially leading to privilege escalation or denial of service. The vulnerability is reachable through unprivileged operations like SYNC_IOC_FILE_INFO.

Compliance Impact

This vulnerability involves a use-after-free flaw in the Linux kernel's DRM subsystem, specifically in the msm driver. It could potentially allow unauthorized memory access or denial-of-service conditions. While not directly impacting GDPR or HIPAA compliance, such kernel vulnerabilities may undermine security controls required by these regulations if exploited to access sensitive data or disrupt systems handling protected information.

Mitigation Strategies

Apply the kernel patch referenced in the CVE description (Patchwork link provided). Update to a kernel version that includes the fix for this issue. If immediate patching is not possible, consider disabling the affected msm DRM driver module to prevent exploitation until patched.

Hi! I’m here to help you understand CVE-2026-98180. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70