{"id":"CVE-2026-68380","state":"PUBLISHED","title":"accel/amdxdna: Fix use-after-free of mm_struct in job scheduler","description":"In the Linux kernel, the following vulnerability has been resolved:\n\naccel/amdxdna: Fix use-after-free of mm_struct in job scheduler\n\namdxdna_cmd_submit() stores current->mm in job->mm without holding any\nreference. aie2_sched_job_run() later access job->mm from the DRM\nscheduler worker thread. With only a raw pointer and no structural\nreference, the mm_struct can be freed before the scheduler runs the job.\n\nFix this by calling mmgrab() to hold a structural mm_count reference for\nthe lifetime of the job, paired with mmdrop() in every cleanup path.","publishedAt":"2026-08-10T12:03:58.536Z","updatedAt":"2026-08-17T05:04:26.414Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"aac243092b707bb3018e951d470cc1a9bcbaba6c","status":"affected","lessThan":"6875ee2bef48f5d9f045d81a8a4d68893f768a8a","versionType":"git"},{"version":"aac243092b707bb3018e951d470cc1a9bcbaba6c","status":"affected","lessThan":"e8fadbffc19a233d1eedebfb8df0f522d1388280","versionType":"git"},{"version":"aac243092b707bb3018e951d470cc1a9bcbaba6c","status":"affected","lessThan":"faebb7ba1ac65fa5810b640df02ce04e509fdc11","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/accel/amdxdna/amdxdna_ctx.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.14","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.14","versionType":"semver"},{"version":"6.18.42","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.6","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/accel/amdxdna/amdxdna_ctx.c"]}],"references":["https://git.kernel.org/stable/c/6875ee2bef48f5d9f045d81a8a4d68893f768a8a","https://git.kernel.org/stable/c/e8fadbffc19a233d1eedebfb8df0f522d1388280","https://git.kernel.org/stable/c/faebb7ba1ac65fa5810b640df02ce04e509fdc11"],"weaknesses":[],"ingestedAt":"2026-10-29T20:12:49.727Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/68xxx/CVE-2026-68380.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-68380","state":"PUBLISHED","datePublished":"2026-08-10T12:03:58.536Z","dateUpdated":"2026-08-17T05:04:26.414Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-07-30T09:28:09.387Z"},"containers":{"cna":{"title":"accel/amdxdna: Fix use-after-free of mm_struct in job scheduler","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\naccel/amdxdna: Fix use-after-free of mm_struct in job scheduler\n\namdxdna_cmd_submit() stores current->mm in job->mm without holding any\nreference. aie2_sched_job_run() later access job->mm from the DRM\nscheduler worker thread. With only a raw pointer and no structural\nreference, the mm_struct can be freed before the scheduler runs the job.\n\nFix this by calling mmgrab() to hold a structural mm_count reference for\nthe lifetime of the job, paired with mmdrop() in every cleanup path."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"aac243092b707bb3018e951d470cc1a9bcbaba6c","status":"affected","lessThan":"6875ee2bef48f5d9f045d81a8a4d68893f768a8a","versionType":"git"},{"version":"aac243092b707bb3018e951d470cc1a9bcbaba6c","status":"affected","lessThan":"e8fadbffc19a233d1eedebfb8df0f522d1388280","versionType":"git"},{"version":"aac243092b707bb3018e951d470cc1a9bcbaba6c","status":"affected","lessThan":"faebb7ba1ac65fa5810b640df02ce04e509fdc11","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/accel/amdxdna/amdxdna_ctx.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.14","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.14","versionType":"semver"},{"version":"6.18.42","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.6","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/accel/amdxdna/amdxdna_ctx.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/6875ee2bef48f5d9f045d81a8a4d68893f768a8a"},{"url":"https://git.kernel.org/stable/c/e8fadbffc19a233d1eedebfb8df0f522d1388280"},{"url":"https://git.kernel.org/stable/c/faebb7ba1ac65fa5810b640df02ce04e509fdc11"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is the AMDXDNA_EXEC_CMD ioctl on the /dev/accel/accel* accel/DRM node, requiring local access to the device file; there is no remote or adjacent-network entry point into the NPU job scheduler.\nAC:L - The attacker controls both sides of the lifetime race: it can saturate the hwctx job semaphore with long-running commands to keep jobs queued, then submit from a forked task sharing the fd and exit that task so its mm_struct is freed while the job is still pending. No condition outside attacker control is needed.\nPR:L - The EXEC_CMD ioctl is registered with no privilege flags (unlike SET_STATE which is DRM_ROOT_ONLY), so any unprivileged local user holding an open handle to the accel render node can submit jobs and trigger the bug.\nUI:N - Exploitation is entirely driven by the attacker's own process tree (open, submit, fork, exit); no victim action or interaction with any other user is required.\nS:U - The use-after-free corrupts kernel memory within the same kernel security authority; there is no crossing of a VM, IOMMU or sandbox boundary as a direct consequence of the flaw.\nC:H - The freed mm_struct is reallocated from a general kernel cache, and the driver's continued use of it (mmget_not_zero, later mmput_async/__mmput walking page tables) gives an attacker who sprays the reclaimed slot a path to disclose arbitrary kernel memory.\nI:H - mmget_not_zero() performs an atomic increment into freed memory and mmput_async() can drive a reclaimed object through __mmput()/exit_mmap(), yielding controlled kernel writes and page-table teardown on attacker-shaped data, i.e. a route to privilege escalation.\nA:H - Even without full exploitation the use-after-free reliably corrupts an mm_struct that the kernel then dereferences and tears down, causing oops or panic and rendering the system unavailable."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-17T05:04:26.414Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.14","versionEndExcluding":"6.18.42"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.14","versionEndExcluding":"7.1.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.14","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}