CVE-2026-68266

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/xe: Hold a dma-buf reference for imported BOs<br /> <br /> An imported dma-buf BO is created as a ttm_bo_type_sg BO whose<br /> reservation object is the exporter&amp;#39;s dma_buf-&gt;resv. The importer,<br /> however, only takes a dma-buf reference after a successful<br /> dma_buf_dynamic_attach(). Until then nothing keeps the exporter alive,<br /> so if the exporter is freed while the BO still references its resv, a<br /> later access to that resv is a use-after-free:<br /> <br /> Oops: general protection fault, probably for non-canonical address<br /> 0x6b6b6b6b6b6b6b9c<br /> Workqueue: ttm ttm_bo_delayed_delete [ttm]<br /> RIP: 0010:mutex_can_spin_on_owner+0x3f/0xc0<br /> <br /> This can be reached on two paths:<br /> <br /> - dma_buf_dynamic_attach() fails, or<br /> - ttm_bo_init_reserved() fails during BO creation.<br /> <br /> In both cases the BO already has bo-&gt;base.resv pointing at the exporter<br /> resv, and sg BOs are always torn down via ttm_bo_delayed_delete(), which<br /> locks bo-&gt;base.resv asynchronously - potentially after the exporter has<br /> been freed.<br /> <br /> Take the dma-buf reference in xe_bo_init_locked(), before<br /> ttm_bo_init_reserved(), so it also covers a creation failure there, and<br /> release it in xe_ttm_bo_destroy(). The reference is held for the whole<br /> BO lifetime, keeping the shared resv alive on every path.<br /> <br /> v2:<br /> - Reworked the fix to avoid creating the imported sg BO before<br /> dma_buf_dynamic_attach() succeeds.<br /> - Attach with importer_priv == NULL and make invalidate_mappings ignore<br /> incomplete imports.<br /> <br /> v3:<br /> - Dropped the xe-side reordering approach since importer_priv must be<br /> valid when dma_buf_dynamic_attach() publishes the attachment.<br /> - Per Christian&amp;#39;s suggestion on the v1 thread, keyed the check on<br /> import_attach rather than removing the sg guard entirely.<br /> - Fixes both xe and amdgpu in a single TTM patch.<br /> <br /> v4:<br /> - Moved import_attach check to after dma_resv_copy_fences() so fences<br /> are copied before returning for successful imports (Thomas).<br /> - Removed exporter-alive claim from commit message (Thomas).<br /> <br /> v5:<br /> - Add drm/xe patch to keep imported sg BOs off the LRU before attach<br /> succeeds; the TTM fix alone is not sufficient for xe if the BO is<br /> already LRU-visible. (Thomas)<br /> v4 patch:<br /> https://patchwork.freedesktop.org/patch/736663/?series=169129&amp;rev=2<br /> - Patch 1 (drm/ttm) carries Christian&amp;#39;s Reviewed-by from v4.<br /> <br /> v6:<br /> - Reworked the fix based on Thomas&amp;#39; suggestion. Instead of the TTM resv<br /> individualization (v1-v5) plus the xe off-LRU/placement handling (v5),<br /> just hold a dma-buf reference for the imported BO lifetime so the<br /> shared resv can never be freed while the BO still references it.<br /> Single xe patch, no TTM change. (Thomas)<br /> - Take the reference in xe_bo_init_locked() before ttm_bo_init_reserved()<br /> so a TTM creation failure is covered too (Thomas).<br /> - Dropped the v5 series (drm/ttm + drm/xe off-LRU); the off-LRU approach<br /> also regressed in CI BAT via ttm_bo_pipeline_gutting() creating a ghost<br /> BO that outlived the exporter.<br /> Link to v5: https://patchwork.freedesktop.org/series/169984/<br /> <br /> v7:<br /> - Move changelog above --- so it stays in the commit message.<br /> - Reorder changelog entries oldest-to-newest. (Thomas)<br /> <br /> (cherry picked from commit 3516f3fae6be35642f8f06f8a218da6425c0306a)