{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-98180",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2026-98180"
  ],
  "published": "2026-10-06T08:47:10Z",
  "summary": "drm/msm: RCU-free the scheduler-containing ring and VM objects",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm: RCU-free the scheduler-containing ring and VM objects\n\nBoth struct msm_ringbuffer and struct msm_gem_vm embed a struct\ndrm_gpu_scheduler.  msm_ringbuffer_destroy() and the VM free callback\nmsm_gem_vm_free() call drm_sched_fini() on the embedded scheduler and then\nfree the containing object with plain kfree().\n\ndrm_sched_fence_get_timeline_name() returns fence->sched->name, and the\nscheduler fence keeps a .release callback so it is not ops-detached on\nsignalling.  A finished fence exported to userspace (the submit out-fence, or\na VM_BIND fence, via sync_file / drm_syncobj) keeps pointing at the embedded\nscheduler after the ring/VM is freed, so a later get_timeline_name() --\nreachable unprivileged through SYNC_IOC_FILE_INFO -- dereferences freed slab\nmemory (KASAN slab-use-after-free read).\n\nPer the dma-fence lifetime contract the exporter must keep the data backing a\nsignalled fence alive for an RCU grace period.  Free the scheduler-containing\nobjects with kfree_rcu() instead of kfree().\n\nPatchwork: https://patchwork.freedesktop.org/patch/750234/",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": null,
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98180"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/d81bf4581903b0cba0698cd4d1c07fc6be21754a"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/713abac5c04ccbae67f9ac68c3921845535388e7"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/01c8d1f385f788f1bbbbb7687c4386d614281218"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-10-07T06:50:27Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 7.1,
      "cvss_v3_severity": "High",
      "scenario": "AV:L - The freed memory is reached by a local process through render-node ioctls (MSM_SET_PARAM to enable VM_BIND, MSM_VM_BIND/MSM_GEM_SUBMIT with an out-fence) followed by SYNC_IOC_FILE_INFO on the exported sync_file. No remote data is involved.\nAC:L - The attacker runs every step: create a user-managed VM, submit a VM_BIND job with an out-fence fd, close the DRM fd so msm_gem_vm_close()/msm_gem_vm_free() kfree the VM, then query the sync_file. They choose when the free happens, so there is no race they can't control.\nPR:L - All msm ioctls used are DRM_RENDER_ALLOW and the sync_file ioctl needs only the fd. An unprivileged user with render-node access (render group, or any Android app with GPU access) can do this without capabilities.\nUI:N - No victim action is needed. The attacker creates and frees the VM and queries the fence entirely through their own file descriptors.\nS:U - This is a use-after-free in the kernel's own memory with impact inside the same kernel authority. No VM, IOMMU or sandbox boundary is crossed.\nC:H - drm_sched_fence_get_timeline_name() returns fence->sched->name from the freed msm_gem_vm. If the slab is refilled with attacker data, that name pointer is attacker-controlled, and sync_fill_fence_info() strscpy()s up to 32 bytes from that address into obj_name returned to userspace. That is a repeatable arbitrary kernel read.\nI:N - Nothing writes through the stale fence->sched: get_timeline_name only reads it and sched_entity.c only compares the pointer. The freed scheduler gives a read primitive, not a write or control-flow primitive.\nA:H - Dereferencing freed or reclaimed memory and strscpy() from a bad name pointer causes a kernel oops/panic (KASAN slab-use-after-free read), which the attacker can trigger repeatedly."
    }
  }
}