CVE-2026-63910
Received Received - Intake

Use-After-Free in Linux Kernel DMA-BUF Subsystem

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: dma-buf: fix UAF in dma_buf_fd() tracepoint Once FD_ADD() returns, the fd is live in the file descriptor table and a thread sharing that table can close() it before DMA_BUF_TRACE() runs. The close drops the last reference, __fput() frees the dma_buf, and the tracepoint then dereferences dmabuf to take dmabuf->name_lock -- slab-use-after-free. Split FD_ADD() back into get_unused_fd_flags() + fd_install() and emit the tracepoint between them. While the fdtable slot is reserved with a NULL file pointer, a racing close() returns -EBADF without entering __fput(), so the dma_buf stays alive across the trace. Same approach as commit 2d76319c4cbb ("dma-buf: fix UAF in dma_buf_put() tracepoint"). This undoes the FD_ADD() conversion done in commit 34dfce523c90 ("dma: convert dma_buf_fd() to FD_ADD()"); FD_ADD() has no place to hook the tracepoint safely.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63910
EUVD
EUVD-2026-45683

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
linux linux_kernel *
linux_kernel linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a use-after-free (UAF) flaw in the Linux kernel's dma-buf subsystem. It occurs when a tracepoint in dma_buf_fd() tries to access a dma_buf object after it has already been freed due to a race condition involving file descriptor operations.

Detection Guidance

This vulnerability is specific to the Linux kernel's dma-buf subsystem and does not have a direct network detection method. Detection requires checking kernel logs for slab-use-after-free errors related to dma_buf_fd() or examining kernel tracepoints for abnormal behavior in dma_buf operations.

Impact Analysis

This vulnerability could allow an attacker to cause a system crash or potentially execute arbitrary code with kernel privileges by exploiting the race condition in file descriptor handling.

Compliance Impact

This vulnerability is a use-after-free flaw in the Linux kernel's dma-buf subsystem that could lead to memory corruption or crashes. It does not directly impact compliance with standards like GDPR or HIPAA, as those focus on data protection and privacy rather than kernel memory safety issues.

Mitigation Strategies

Apply the latest kernel patches that address this issue. Monitor kernel logs for slab-use-after-free errors in dma_buf_fd() and update to a patched kernel version if available. No user-space commands are required for mitigation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63910. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart