PT-2026-61227 · Linux · Linux

CVE-2026-63910 · Published 2026-07-19 · Updated 2026-07-19

Mitre

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

dma-buf: fix UAF in dma buf fd() tracepoint

Once FD ADD() returns, the fd is live in the file descriptor table and a thread sharing that table can close() it before DMA BUF TRACE() runs. The close drops the last reference, fput() frees the dma buf, and the tracepoint then dereferences dmabuf to take dmabuf->name lock -- slab-use-after-free.

Split FD ADD() back into get unused fd flags() + fd install() and emit the tracepoint between them. While the fdtable slot is reserved with a NULL file pointer, a racing close() returns -EBADF without entering fput(), so the dma buf stays alive across the trace. Same approach as commit 2d76319c4cbb ("dma-buf: fix UAF in dma buf put() tracepoint").

This undoes the FD ADD() conversion done in commit 34dfce523c90 ("dma: convert dma buf fd() to FD ADD()"); FD ADD() has no place to hook the tracepoint safely.

Fix

Related Identifiers

CVE-2026-63910

Affected Products

Linux

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-63910 · Security Note
• https://git.kernel.org/stable/c/ead6680f354f83966c796fc7f9463a3171789616 · Note
• https://git.kernel.org/stable/c/b569f86e2f8dbf6f11d31d3de794d22e18098b23 · Note