{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-68266 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-68266 is a high-severity use after free vulnerability in Linux, published on 10 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-68266 and fix it if it is affected.\n\nWhat it is: CVE-2026-68266 is a high-severity use after free vulnerability in Linux, published on 10 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-68266 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-68266/ (Markdown: https://insights.sbomify.com/CVE-2026-68266/index.md)","id":"CVE-2026-68266","markdown":"https://insights.sbomify.com/CVE-2026-68266/index.md","name":"CVE-2026-68266","record":{"aliases":["BELL-CVE-2026-68266","DEBIAN-CVE-2026-68266","GHSA-9jm7-867x-hm4j","UBUNTU-CVE-2026-68266"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["code_execution","denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel driver","requires_auth":"low_privilege","summary":"A use-after-free in the Linux kernel's Xe GPU driver allows attackers to cause a system crash or potentially execute code via crafted DMA buffer imports.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":7.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-416","name":"Use After Free"}],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Hold a dma-buf reference for imported BOs\n\nAn imported dma-buf BO is created as a ttm_bo_type_sg BO whose\nreservation object is the exporter's dma_buf-\u003eresv. The importer,\nhowever, only takes a dma-buf reference after a successful\ndma_buf_dynamic_attach(). Until then nothing keeps the exporter alive,\nso if the exporter is freed while the BO still references its resv, a\nlater access to that resv is a use-after-free:\n\n  Oops: general protection fault, probably for non-canonical address\n        0x6b6b6b6b6b6b6b9c\n  Workqueue: ttm ttm_bo_delayed_delete [ttm]\n  RIP: 0010:mutex_can_spin_on_owner+0x3f/0xc0\n\nThis can be reached on two paths:\n\n - dma_buf_dynamic_attach() fails, or\n - ttm_bo_init_reserved() fails during BO creation.\n\nIn both cases the BO already has bo-\u003ebase.resv pointing at the exporter\nresv, and sg BOs are always torn down via ttm_bo_delayed_delete(), which\nlocks bo-\u003ebase.resv asynchronously - potentially after the exporter has\nbeen freed.\n\nTake the dma-buf reference in xe_bo_init_locked(), before\nttm_bo_init_reserved(), so it also covers a creation failure there, and\nrelease it in xe_ttm_bo_destroy(). The reference is held for the whole\nBO lifetime, keeping the shared resv alive on every path.\n\nv2:\n  - Reworked the fix to avoid creating the imported sg BO before\n    dma_buf_dynamic_attach() succeeds.\n  - Attach with importer_priv == NULL and make invalidate_mappings ignore\n    incomplete imports.\n\nv3:\n  - Dropped the xe-side reordering approach since importer_priv must be\n    valid when dma_buf_dynamic_attach() publishes the attachment.\n  - Per Christian's suggestion on the v1 thread, keyed the check on\n    import_attach rather than removing the sg guard entirely.\n  - Fixes both xe and amdgpu in a single TTM patch.\n\nv4:\n  - Moved import_attach check to after dma_resv_copy_fences() so fences\n    are copied before returning for successful imports (Thomas).\n  - Removed exporter-alive claim from commit message (Thomas).\n\nv5:\n  - Add drm/xe patch to keep imported sg BOs off the LRU before attach\n    succeeds; the TTM fix alone is not sufficient for xe if the BO is\n    already LRU-visible. (Thomas)\n    v4 patch:\n    https://patchwork.freedesktop.org/patch/736663/?series=169129\u0026rev=2\n  - Patch 1 (drm/ttm) carries Christian's Reviewed-by from v4.\n\nv6:\n  - Reworked the fix based on Thomas' suggestion. Instead of the TTM resv\n    individualization (v1-v5) plus the xe off-LRU/placement handling (v5),\n    just hold a dma-buf reference for the imported BO lifetime so the\n    shared resv can never be freed while the BO still references it.\n    Single xe patch, no TTM change. (Thomas)\n  - Take the reference in xe_bo_init_locked() before ttm_bo_init_reserved()\n    so a TTM creation failure is covered too (Thomas).\n  - Dropped the v5 series (drm/ttm + drm/xe off-LRU); the off-LRU approach\n    also regressed in CI BAT via ttm_bo_pipeline_gutting() creating a ghost\n    BO that outlived the exporter.\n    Link to v5: https://patchwork.freedesktop.org/series/169984/\n\nv7:\n  - Move changelog above --- so it stays in the commit message.\n  - Reorder changelog entries oldest-to-newest. (Thomas)\n\n(cherry picked from commit 3516f3fae6be35642f8f06f8a218da6425c0306a)","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"drm/xe: Hold a dma-buf reference for imported BOs","id":"CVE-2026-68266","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"use_after_free","year":"2026"},"n_packages":0,"n_references":4,"next":{"headline":"drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists","id":"CVE-2026-68267"},"packages":[],"prev":{"headline":"drm/xe/vm: Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOC","id":"CVE-2026-68265"},"products":["Linux"],"published":"2026-08-10","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A use-after-free in the Linux kernel's Xe GPU driver allows attackers to cause a system crash or potentially execute code via crafted DMA buffer imports.","url":"https://insights.sbomify.com/CVE-2026-68266/"}