CVE-2026-68383

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

Exploitation requires ioctls on the local DRM render node (/dev/dri/renderD128) plus a sync_file fd held by the attacker's process; there is no remote or adjacent-network path into the xe exec-queue lifecycle.

AC:LAttack complexity, low

No race is needed — once __xe_exec_queue_free() kfree()s the queue, sched->name is permanently dangling, so the attacker performs create-queue, export fence, destroy queue, groom the slab, then read, and can retry indefinitely.

PR:LPrivileges required, low

XE_EXEC_QUEUE_CREATE/DESTROY, XE_EXEC, SYNCOBJ_EXPORT_SYNC_FILE and SYNC_IOC_FILE_INFO are all DRM_RENDER_ALLOW with no DRM_AUTH or capability gate, so any local user with render-node access (default for desktop sessions, Android/ChromeOS apps, GPU-passthrough containers) qualifies.

UI:NUser interaction, none

The attacker drives the whole sequence inside its own process using its own exec queue and its own exported fence; no victim action or configuration change is required.

S:UScope, unchanged

The use-after-free is on kernel slab memory and its impact stays inside the kernel's own security authority; no VM, IOMMU or hypervisor boundary is crossed.

C:HConfidentiality impact, high

sync_fill_fence_info() strscpy()s from the freed q->name and copy_to_user()s the result, so after reallocating the freed xe_exec_queue slot the attacker reads back kernel heap contents (pointers, residual data) repeatably — a kernel memory disclosure primitive.

I:HIntegrity impact, high

This is a use-after-free on a kfree()d slab object whose contents the attacker grooms; the stale pointer is dereferenced as a string by kernel and tracepoint consumers, and UAF of an attacker-controllable slot is leverageable for corruption and control-flow influence.

A:HAvailability impact, high

Dereferencing the dangling name pointer after the slab page is returned to the buddy allocator, or scanning for a NUL past the freed object, faults in kernel context and oopses the machine, which any unprivileged render-node user can trigger at will.