CVE-2026-63910: Linux Kernel Use-After-Free Vulnerability

CVE-2026-63910 Overview

CVE-2026-63910 is a use-after-free vulnerability in the Linux kernel dma-buf subsystem. The flaw resides in the dma_buf_fd() tracepoint, where a race condition allows a thread to free the dma_buf object while the tracepoint still holds a stale reference. Once FD_ADD() returns, the file descriptor becomes live in the file descriptor table. A thread sharing that table can invoke close() before DMA_BUF_TRACE() executes, causing __fput() to release the last reference and free the buffer. The tracepoint then dereferences the freed dmabuf pointer to acquire dmabuf->name_lock, producing a slab-use-after-free condition.

Critical Impact
Local attackers with the ability to run code on the system can trigger memory corruption in the kernel, potentially leading to privilege escalation, kernel crash, or arbitrary code execution in kernel context.

Affected Products

Linux kernel versions containing commit 34dfce523c90 ("dma: convert dma_buf_fd() to FD_ADD()")
Distributions shipping affected upstream kernel builds with the dma-buf subsystem enabled
Systems where userspace applications share file descriptor tables across threads and use dma-buf

Discovery Timeline

2026-07-19 - CVE-2026-63910 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63910

Vulnerability Analysis

The vulnerability is a classic use-after-free race condition in the dma_buf_fd() function. The dma-buf subsystem provides a mechanism for sharing DMA buffers between kernel drivers and userspace. When userspace requests a file descriptor for a dma-buf via dma_buf_fd(), the kernel installs the file descriptor and emits a tracepoint for observability.

A previous refactor in commit 34dfce523c90 converted the descriptor allocation to use the combined FD_ADD() helper. This helper atomically reserves an unused file descriptor and installs the file pointer. The problem is that FD_ADD() leaves no window between reserving the slot and making it visible to other threads through fd_install(). Once installed, another thread sharing the file descriptor table can immediately close() the descriptor, triggering __fput() and freeing the dma_buf.

The tracepoint DMA_BUF_TRACE() runs after FD_ADD() and dereferences the dmabuf pointer to read dmabuf->name_lock. If the racing close() has already freed the buffer, this dereference operates on freed slab memory.

Root Cause

The root cause is improper ordering between file descriptor installation and tracepoint emission. FD_ADD() publishes the file pointer to the fdtable atomically, eliminating the safe window during which the buffer's lifetime was guaranteed. The tracepoint code path assumes the dma_buf remains valid, but the sharing semantics of CLONE_FILES threads break that assumption.

Attack Vector

A local attacker exploits the flaw by creating threads that share a file descriptor table using clone() with CLONE_FILES. One thread requests a dma-buf file descriptor while a sibling thread aggressively closes descriptors as they appear. Winning the race causes the tracepoint to dereference a freed slab object. Attackers can shape kernel heap layout to control the freed memory contents, converting the use-after-free into a controlled kernel write primitive for privilege escalation.

The fix splits FD_ADD() back into get_unused_fd_flags() and fd_install(), emitting the tracepoint between them. While the fdtable slot holds a NULL file pointer, a racing close() returns -EBADF without entering __fput(), keeping the dma_buf alive across the trace. This mirrors the approach in commit 2d76319c4cbb ("dma-buf: fix UAF in dma_buf_put() tracepoint").

Detection Methods for CVE-2026-63910

Indicators of Compromise

Kernel panic or oops messages referencing dma_buf_fd, dma_buf_release, or name_lock in the call trace
KASAN reports flagging slab-use-after-free in the dma-buf subsystem
Unexpected process crashes or system instability on hosts with graphics, media, or GPU workloads that heavily use dma-buf
Presence of the vulnerable commit 34dfce523c90 without the fix commits b569f86e2f8d or ead6680f354f

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test and staging kernels to catch use-after-free conditions during fuzzing
Audit installed kernel versions against distribution advisories to identify unpatched builds
Monitor dmesg and journalctl output for dma-buf related warnings, oopses, or KASAN splats

Monitoring Recommendations

Collect kernel crash dumps and forward them to a centralized log platform for review
Track unusual process termination patterns tied to graphics or media workloads that use dma-buf
Alert on repeated invocations of clone() with CLONE_FILES followed by rapid file descriptor churn from non-privileged users

How to Mitigate CVE-2026-63910

Immediate Actions Required

Apply the upstream kernel patches referenced by commits b569f86e2f8dbf6f11d31d3de794d22e18098b23 and ead6680f354f83966c796fc7f9463a3171789616 as soon as distribution builds become available
Restrict local shell access on multi-tenant systems, since exploitation requires local code execution
Inventory kernel versions across the fleet to identify hosts running vulnerable builds

Patch Information

The fix reverts the FD_ADD() conversion in dma_buf_fd() and restores the original two-step pattern of get_unused_fd_flags() followed by fd_install(), with the tracepoint emitted between them. Patches are available at Kernel Git Commit b569f86e2f8d and Kernel Git Commit ead6680f354f. Rebuild and redeploy affected kernels after applying these commits, or install vendor-provided updated kernel packages.

Workarounds

Disable the dma_buf_fd tracepoint at runtime if tracing is not required, removing the vulnerable code path
Limit access to workloads that exercise dma-buf (GPU compute, video pipelines) to trusted users only
Apply SELinux or AppArmor policies to constrain unprivileged process capabilities on shared-tenant systems

bash

# Disable the dma_buf_fd tracepoint at runtime to remove the vulnerable trace path
echo 0 > /sys/kernel/debug/tracing/events/dma_fence/dma_buf_fd/enable

# Verify installed kernel version against patched builds
uname -r

# Check distribution advisory status for the running kernel
rpm -q kernel   # RHEL/CentOS/Fedora
dpkg -l linux-image-$(uname -r)   # Debian/Ubuntu