GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-68383 (GCVE-0-2026-68383)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:04 – Updated: 2026-08-17 05:04
VLAI
Title
drm/xe/guc: Keep scheduler timeline name alive
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Keep scheduler timeline name alive The scheduler keeps a pointer to the timeline name, but q->name is freed with the exec queue while scheduler fences can still reference it. Store the name in struct xe_guc_exec_queue so it shares the scheduler's RCU-deferred lifetime. (cherry picked from commit 41075f0eb5dcbd3b065d15f15ef7bbe9315188e8)
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 6bd90e700b4285e6a7541e00f969cab0d696adde , < 77fd62412431e8c80ef2ad61466bc76fe425f80a (git)
Affected: 6bd90e700b4285e6a7541e00f969cab0d696adde , < 299bc6d50b1bed7d1f408391736712f01a0855e2 (git)
Affected: b17fcce70733c211cb5dabf54f4f9491920b1d92 (git)
Affected: ba37807d08bae67de6139346a85650cab5f6145a (git)
Affected: 683b0e397dad9f26a42dcacf6f7f545a77ce6c06 (git)
Affected: 6.12.43 , < 6.13 (semver)
Affected: 6.15.11 , < 6.16 (semver)
Affected: 6.16.2 , < 6.17 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.17
Unaffected: 0 , < 6.17 (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_guc_exec_queue_types.h",
            "drivers/gpu/drm/xe/xe_guc_submit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "77fd62412431e8c80ef2ad61466bc76fe425f80a",
              "status": "affected",
              "version": "6bd90e700b4285e6a7541e00f969cab0d696adde",
              "versionType": "git"
            },
            {
              "lessThan": "299bc6d50b1bed7d1f408391736712f01a0855e2",
              "status": "affected",
              "version": "6bd90e700b4285e6a7541e00f969cab0d696adde",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b17fcce70733c211cb5dabf54f4f9491920b1d92",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ba37807d08bae67de6139346a85650cab5f6145a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "683b0e397dad9f26a42dcacf6f7f545a77ce6c06",
              "versionType": "git"
            },
            {
              "lessThan": "6.13",
              "status": "affected",
              "version": "6.12.43",
              "versionType": "semver"
            },
            {
              "lessThan": "6.16",
              "status": "affected",
              "version": "6.15.11",
              "versionType": "semver"
            },
            {
              "lessThan": "6.17",
              "status": "affected",
              "version": "6.16.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_guc_exec_queue_types.h",
            "drivers/gpu/drm/xe/xe_guc_submit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "lessThan": "6.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.12.43",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.15.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.16.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/guc: Keep scheduler timeline name alive\n\nThe scheduler keeps a pointer to the timeline name, but q-\u003ename\nis freed with the exec queue while scheduler fences can still\nreference it.\n\nStore the name in struct xe_guc_exec_queue so it shares\nthe scheduler\u0027s RCU-deferred lifetime.\n\n(cherry picked from commit 41075f0eb5dcbd3b065d15f15ef7bbe9315188e8)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires ioctls on the local DRM render node (/dev/dri/renderD128) plus a sync_file fd held by the attacker\u0027s process; there is no remote or adjacent-network path into the xe exec-queue lifecycle.\nAC:L - No race is needed \u2014 once __xe_exec_queue_free() kfree()s the queue, sched-\u003ename is permanently dangling, so the attacker performs create-queue, export fence, destroy queue, groom the slab, then read, and can retry indefinitely.\nPR:L - XE_EXEC_QUEUE_CREATE/DESTROY, XE_EXEC, SYNCOBJ_EXPORT_SYNC_FILE and SYNC_IOC_FILE_INFO are all DRM_RENDER_ALLOW with no DRM_AUTH or capability gate, so any local user with render-node access (default for desktop sessions, Android/ChromeOS apps, GPU-passthrough containers) qualifies.\nUI:N - The attacker drives the whole sequence inside its own process using its own exec queue and its own exported fence; no victim action or configuration change is required.\nS:U - The use-after-free is on kernel slab memory and its impact stays inside the kernel\u0027s own security authority; no VM, IOMMU or hypervisor boundary is crossed.\nC:H - sync_fill_fence_info() strscpy()s from the freed q-\u003ename and copy_to_user()s the result, so after reallocating the freed xe_exec_queue slot the attacker reads back kernel heap contents (pointers, residual data) repeatably \u2014 a kernel memory disclosure primitive.\nI:H - This is a use-after-free on a kfree()d slab object whose contents the attacker grooms; the stale pointer is dereferenced as a string by kernel and tracepoint consumers, and UAF of an attacker-controllable slot is leverageable for corruption and control-flow influence.\nA:H - Dereferencing the dangling name pointer after the slab page is returned to the buddy allocator, or scanning for a NUL past the freed object, faults in kernel context and oopses the machine, which any unprivileged render-node user can trigger at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:04:29.739Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/77fd62412431e8c80ef2ad61466bc76fe425f80a"
        },
        {
          "url": "https://git.kernel.org/stable/c/299bc6d50b1bed7d1f408391736712f01a0855e2"
        }
      ],
      "title": "drm/xe/guc: Keep scheduler timeline name alive",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68383",
    "datePublished": "2026-08-10T12:04:02.230Z",
    "dateReserved": "2026-07-30T09:28:09.387Z",
    "dateUpdated": "2026-08-17T05:04:29.739Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68383",
      "date": "2026-09-16",
      "epss": "0.00129",
      "percentile": "0.02921"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-68383\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-10T13:20:31.483\",\"lastModified\":\"2026-08-17T06:17:46.817\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/xe/guc: Keep scheduler timeline name alive\\n\\nThe scheduler keeps a pointer to the timeline name, but q-\u003ename\\nis freed with the exec queue while scheduler fences can still\\nreference it.\\n\\nStore the name in struct xe_guc_exec_queue so it shares\\nthe scheduler\u0027s RCU-deferred lifetime.\\n\\n(cherry picked from commit 41075f0eb5dcbd3b065d15f15ef7bbe9315188e8)\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/xe/xe_guc_exec_queue_types.h\",\"drivers/gpu/drm/xe/xe_guc_submit.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6bd90e700b4285e6a7541e00f969cab0d696adde\",\"lessThan\":\"77fd62412431e8c80ef2ad61466bc76fe425f80a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6bd90e700b4285e6a7541e00f969cab0d696adde\",\"lessThan\":\"299bc6d50b1bed7d1f408391736712f01a0855e2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b17fcce70733c211cb5dabf54f4f9491920b1d92\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ba37807d08bae67de6139346a85650cab5f6145a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"683b0e397dad9f26a42dcacf6f7f545a77ce6c06\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.12.43\",\"lessThan\":\"6.13\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.15.11\",\"lessThan\":\"6.16\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.16.2\",\"lessThan\":\"6.17\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/xe/xe_guc_exec_queue_types.h\",\"drivers/gpu/drm/xe/xe_guc_submit.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.6\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/299bc6d50b1bed7d1f408391736712f01a0855e2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/77fd62412431e8c80ef2ad61466bc76fe425f80a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-31T11:23:59+00:00",
      "cve": "CVE-2026-68383",
      "id": "CVE-2026-68383",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "93",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/xe/guc: Keep scheduler timeline name alive",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68383.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:35:01Z",
      "cve": "CVE-2026-68383",
      "id": "CVE-2026-68383",
      "initial_release_date": "2026-08-12T16:22:25Z",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "298",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68383",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68383.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.