CVE-2026-68266

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the drm/xe component of the Linux kernel. An imported dma-buf Buffer Object (BO) is created as a ttm bo type sg BO that references the exporter's reservation object dma buf->resv. Because the importer only takes a dma-buf reference after a successful dma buf dynamic attach() call, the exporter can be freed while the BO still references its reservation object. This leads to a use-after-free when the reservation object is later accessed, specifically during the asynchronous teardown of sg BOs via the ttm bo delayed delete() function. This condition can be triggered if dma buf dynamic attach() fails or if ttm bo init reserved() fails during BO creation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.