CVE-2026-68266 Overview
CVE-2026-68266 is a use-after-free vulnerability in the Linux kernel's drm/xe graphics driver. The flaw affects imported dma-buf buffer objects (BOs) created as ttm_bo_type_sg BOs whose reservation object points to the exporter's dma_buf->resv. The importer only takes a dma-buf reference after a successful dma_buf_dynamic_attach() call. If the exporter is freed before that reference is acquired, later access to the reservation object through ttm_bo_delayed_delete() dereferences freed memory. The condition is reachable when dma_buf_dynamic_attach() fails or when ttm_bo_init_reserved() fails during BO creation.
Critical Impact
A local attacker with graphics device access can trigger a kernel use-after-free that may enable privilege escalation or denial of service on systems using the xe GPU driver.
Affected Products
- Linux kernel builds including the drm/xe driver prior to the patched commits
- Systems using Intel GPU stacks that rely on the xe kernel driver
- Kernel branches referenced by stable commits 62775525, ba8c4cbb, c1954c66, and c22d65d6
Discovery Timeline
- 2026-08-10 - CVE-2026-68266 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-68266
Vulnerability Analysis
The vulnerability resides in how the xe DRM driver initializes imported dma-buf buffer objects. An imported BO is instantiated as a ttm_bo_type_sg object with bo->base.resv set to the exporter's shared reservation object. The importer's lifetime dependency on the exporter, however, is only established when dma_buf_dynamic_attach() completes successfully and the dma-buf reference count is incremented.
When either dma_buf_dynamic_attach() or ttm_bo_init_reserved() fails during BO creation, the BO exists briefly with bo->base.resv still pointing at the exporter's reservation object but without holding a reference to keep the exporter alive. Scatter-gather BOs are torn down asynchronously through ttm_bo_delayed_delete(), which acquires bo->base.resv later in a workqueue context. If the exporter has been freed by then, the mutex operation dereferences a poisoned pointer, as shown in the reported oops at mutex_can_spin_on_owner+0x3f/0xc0 with address 0x6b6b6b6b6b6b6b9c (the SLUB_RED_INACTIVE poison pattern).
Root Cause
The root cause is missing reference counting on the exporter dma-buf during the window between BO allocation and successful attach. The imported BO adopts the exporter's resv pointer before any reference guarantees the exporter's lifetime. This creates a use-after-free [CWE-416] path through the delayed-delete workqueue.
Attack Vector
Exploitation requires local access with the ability to invoke DRM PRIME import ioctls against the xe driver. An attacker triggers repeated imports under conditions that force dma_buf_dynamic_attach() or ttm_bo_init_reserved() to fail while racing exporter teardown. Successful exploitation corrupts kernel memory through the delayed-delete workqueue, potentially yielding kernel-mode code execution.
No public proof-of-concept exploit is available, and the vulnerability is not listed in CISA KEV. See the kernel patch commit c22d65d6 for the corrective change.
Detection Methods for CVE-2026-68266
Indicators of Compromise
- Kernel oops messages referencing mutex_can_spin_on_owner invoked from ttm_bo_delayed_delete in the ttm workqueue
- General protection faults with poison-pattern addresses such as 0x6b6b6b6b6b6b6b9c in kernel logs
- Repeated failures of dma_buf_dynamic_attach() correlated with GPU import operations from unprivileged processes
Detection Strategies
- Monitor dmesg and journald for kernel general protection faults originating in drm/xe or ttm code paths
- Enable KASAN on test kernels to surface use-after-free reports in ttm_bo_delayed_delete during fuzzing
- Audit process telemetry for unprivileged binaries repeatedly invoking DRM_IOCTL_PRIME_FD_TO_HANDLE against /dev/dri/renderD*
Monitoring Recommendations
- Forward kernel logs to a centralized logging platform and alert on GPF signatures involving ttm or drm/xe
- Track kernel version and patch level across Linux fleet endpoints to identify unpatched hosts running the xe driver
- Correlate crash dumps with process ancestry to detect potential exploitation attempts
How to Mitigate CVE-2026-68266
Immediate Actions Required
- Apply the upstream kernel patches referenced by commits 62775525, ba8c4cbb, c1954c66, and c22d65d6 from your distribution vendor
- Restrict access to /dev/dri/renderD* and /dev/dri/card* device nodes to trusted users and groups only
- Reboot affected systems after patch deployment to ensure the vulnerable kernel image is unloaded
Patch Information
The fix takes a dma-buf reference inside xe_bo_init_locked() before ttm_bo_init_reserved() runs, and releases it in xe_ttm_bo_destroy(). The reference is held for the entire BO lifetime so the shared resv cannot be freed while the BO still references it. The commit was cherry-picked from mainline 3516f3fae6be35642f8f06f8a218da6425c0306a. Distributions shipping the xe driver should pull the stable backports linked in the kernel.org stable tree.
Workarounds
- Blacklist the xe kernel module on systems that do not require Intel Xe graphics acceleration until patches are applied
- Disable unprivileged user access to DRM render nodes via udev rules or container seccomp policies
- Constrain container and sandbox workloads from accessing GPU devices where the xe driver is loaded
# Blacklist the xe driver until the kernel is patched
echo 'blacklist xe' | sudo tee /etc/modprobe.d/blacklist-xe.conf
sudo update-initramfs -u
# Verify the module is not loaded after reboot
lsmod | grep -w xe
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
