{"api_version":"1","generated_at":"2026-08-15T02:49:12+00:00","cve":"CVE-2026-68383","urls":{"html":"https://cve.report/CVE-2026-68383","api":"https://cve.report/api/cve/CVE-2026-68383.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-68383","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-68383"},"summary":{"title":"drm/xe/guc: Keep scheduler timeline name alive","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/guc: Keep scheduler timeline name alive\n\nThe scheduler keeps a pointer to the timeline name, but q->name\nis freed with the exec queue while scheduler fences can still\nreference it.\n\nStore the name in struct xe_guc_exec_queue so it shares\nthe scheduler's RCU-deferred lifetime.\n\n(cherry picked from commit 41075f0eb5dcbd3b065d15f15ef7bbe9315188e8)","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-10 13:20:31","updated_at":"2026-08-13 23:17:33"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/77fd62412431e8c80ef2ad61466bc76fe425f80a","name":"https://git.kernel.org/stable/c/77fd62412431e8c80ef2ad61466bc76fe425f80a","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/299bc6d50b1bed7d1f408391736712f01a0855e2","name":"https://git.kernel.org/stable/c/299bc6d50b1bed7d1f408391736712f01a0855e2","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-68383","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68383","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6bd90e700b4285e6a7541e00f969cab0d696adde 77fd62412431e8c80ef2ad61466bc76fe425f80a git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6bd90e700b4285e6a7541e00f969cab0d696adde 299bc6d50b1bed7d1f408391736712f01a0855e2 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected b17fcce70733c211cb5dabf54f4f9491920b1d92 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ba37807d08bae67de6139346a85650cab5f6145a git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 683b0e397dad9f26a42dcacf6f7f545a77ce6c06 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.12.43 6.13 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.15.11 6.16 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.16.2 6.17 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.17","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.17 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.6 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2-rc4 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"68383","cve":"CVE-2026-68383","epss":"0.001290000","percentile":"0.029820000","score_date":"2026-08-14","updated_at":"2026-08-15 00:04:43"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/xe/xe_guc_exec_queue_types.h","drivers/gpu/drm/xe/xe_guc_submit.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"77fd62412431e8c80ef2ad61466bc76fe425f80a","status":"affected","version":"6bd90e700b4285e6a7541e00f969cab0d696adde","versionType":"git"},{"lessThan":"299bc6d50b1bed7d1f408391736712f01a0855e2","status":"affected","version":"6bd90e700b4285e6a7541e00f969cab0d696adde","versionType":"git"},{"status":"affected","version":"b17fcce70733c211cb5dabf54f4f9491920b1d92","versionType":"git"},{"status":"affected","version":"ba37807d08bae67de6139346a85650cab5f6145a","versionType":"git"},{"status":"affected","version":"683b0e397dad9f26a42dcacf6f7f545a77ce6c06","versionType":"git"},{"lessThan":"6.13","status":"affected","version":"6.12.43","versionType":"semver"},{"lessThan":"6.16","status":"affected","version":"6.15.11","versionType":"semver"},{"lessThan":"6.17","status":"affected","version":"6.16.2","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/xe/xe_guc_exec_queue_types.h","drivers/gpu/drm/xe/xe_guc_submit.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.17"},{"lessThan":"6.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2-rc4","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.6","versionStartIncluding":"6.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2-rc4","versionStartIncluding":"6.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12.43","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.15.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.16.2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/guc: Keep scheduler timeline name alive\n\nThe scheduler keeps a pointer to the timeline name, but q->name\nis freed with the exec queue while scheduler fences can still\nreference it.\n\nStore the name in struct xe_guc_exec_queue so it shares\nthe scheduler's RCU-deferred lifetime.\n\n(cherry picked from commit 41075f0eb5dcbd3b065d15f15ef7bbe9315188e8)"}],"metrics":[{"cvssV3_1":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires ioctls on the local DRM render node (/dev/dri/renderD128) plus a sync_file fd held by the attacker's process; there is no remote or adjacent-network path into the xe exec-queue lifecycle.\nAC:L - No race is needed — once __xe_exec_queue_free() kfree()s the queue, sched->name is permanently dangling, so the attacker performs create-queue, export fence, destroy queue, groom the slab, then read, and can retry indefinitely.\nPR:L - XE_EXEC_QUEUE_CREATE/DESTROY, XE_EXEC, SYNCOBJ_EXPORT_SYNC_FILE and SYNC_IOC_FILE_INFO are all DRM_RENDER_ALLOW with no DRM_AUTH or capability gate, so any local user with render-node access (default for desktop sessions, Android/ChromeOS apps, GPU-passthrough containers) qualifies.\nUI:N - The attacker drives the whole sequence inside its own process using its own exec queue and its own exported fence; no victim action or configuration change is required.\nS:U - The use-after-free is on kernel slab memory and its impact stays inside the kernel's own security authority; no VM, IOMMU or hypervisor boundary is crossed.\nC:H - sync_fill_fence_info() strscpy()s from the freed q->name and copy_to_user()s the result, so after reallocating the freed xe_exec_queue slot the attacker reads back kernel heap contents (pointers, residual data) repeatably — a kernel memory disclosure primitive.\nI:H - This is a use-after-free on a kfree()d slab object whose contents the attacker grooms; the stale pointer is dereferenced as a string by kernel and tracepoint consumers, and UAF of an attacker-controllable slot is leverageable for corruption and control-flow influence.\nA:H - Dereferencing the dangling name pointer after the slab page is returned to the buddy allocator, or scanning for a NUL past the freed object, faults in kernel context and oopses the machine, which any unprivileged render-node user can trigger at will."}]}],"providerMetadata":{"dateUpdated":"2026-08-13T22:44:07.053Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/77fd62412431e8c80ef2ad61466bc76fe425f80a"},{"url":"https://git.kernel.org/stable/c/299bc6d50b1bed7d1f408391736712f01a0855e2"}],"title":"drm/xe/guc: Keep scheduler timeline name alive","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-68383","datePublished":"2026-08-10T12:04:02.230Z","dateReserved":"2026-07-30T09:28:09.387Z","dateUpdated":"2026-08-13T22:44:07.053Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-10 13:20:31","lastModifiedDate":"2026-08-13 23:17:33","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"68383","Ordinal":"1","Title":"drm/xe/guc: Keep scheduler timeline name alive","CVE":"CVE-2026-68383","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"68383","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/guc: Keep scheduler timeline name alive\n\nThe scheduler keeps a pointer to the timeline name, but q->name\nis freed with the exec queue while scheduler fences can still\nreference it.\n\nStore the name in struct xe_guc_exec_queue so it shares\nthe scheduler's RCU-deferred lifetime.\n\n(cherry picked from commit 41075f0eb5dcbd3b065d15f15ef7bbe9315188e8)","Type":"Description","Title":"drm/xe/guc: Keep scheduler timeline name alive"}]}}}