{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-68380","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-07-30T09:28:09.387Z","datePublished":"2026-08-10T12:03:58.536Z","dateUpdated":"2026-08-17T05:04:26.414Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-17T05:04:26.414Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\naccel/amdxdna: Fix use-after-free of mm_struct in job scheduler\n\namdxdna_cmd_submit() stores current->mm in job->mm without holding any\nreference. aie2_sched_job_run() later access job->mm from the DRM\nscheduler worker thread. With only a raw pointer and no structural\nreference, the mm_struct can be freed before the scheduler runs the job.\n\nFix this by calling mmgrab() to hold a structural mm_count reference for\nthe lifetime of the job, paired with mmdrop() in every cleanup path."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is the AMDXDNA_EXEC_CMD ioctl on the /dev/accel/accel* accel/DRM node, requiring local access to the device file; there is no remote or adjacent-network entry point into the NPU job scheduler.\nAC:L - The attacker controls both sides of the lifetime race: it can saturate the hwctx job semaphore with long-running commands to keep jobs queued, then submit from a forked task sharing the fd and exit that task so its mm_struct is freed while the job is still pending. No condition outside attacker control is needed.\nPR:L - The EXEC_CMD ioctl is registered with no privilege flags (unlike SET_STATE which is DRM_ROOT_ONLY), so any unprivileged local user holding an open handle to the accel render node can submit jobs and trigger the bug.\nUI:N - Exploitation is entirely driven by the attacker's own process tree (open, submit, fork, exit); no victim action or interaction with any other user is required.\nS:U - The use-after-free corrupts kernel memory within the same kernel security authority; there is no crossing of a VM, IOMMU or sandbox boundary as a direct consequence of the flaw.\nC:H - The freed mm_struct is reallocated from a general kernel cache, and the driver's continued use of it (mmget_not_zero, later mmput_async/__mmput walking page tables) gives an attacker who sprays the reclaimed slot a path to disclose arbitrary kernel memory.\nI:H - mmget_not_zero() performs an atomic increment into freed memory and mmput_async() can drive a reclaimed object through __mmput()/exit_mmap(), yielding controlled kernel writes and page-table teardown on attacker-shaped data, i.e. a route to privilege escalation.\nA:H - Even without full exploitation the use-after-free reliably corrupts an mm_struct that the kernel then dereferences and tears down, causing oops or panic and rendering the system unavailable."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/accel/amdxdna/amdxdna_ctx.c"],"versions":[{"version":"aac243092b707bb3018e951d470cc1a9bcbaba6c","lessThan":"6875ee2bef48f5d9f045d81a8a4d68893f768a8a","status":"affected","versionType":"git"},{"version":"aac243092b707bb3018e951d470cc1a9bcbaba6c","lessThan":"e8fadbffc19a233d1eedebfb8df0f522d1388280","status":"affected","versionType":"git"},{"version":"aac243092b707bb3018e951d470cc1a9bcbaba6c","lessThan":"faebb7ba1ac65fa5810b640df02ce04e509fdc11","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/accel/amdxdna/amdxdna_ctx.c"],"versions":[{"version":"6.14","status":"affected"},{"version":"0","lessThan":"6.14","status":"unaffected","versionType":"semver"},{"version":"6.18.42","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.6","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.14","versionEndExcluding":"6.18.42"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.14","versionEndExcluding":"7.1.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.14","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/6875ee2bef48f5d9f045d81a8a4d68893f768a8a"},{"url":"https://git.kernel.org/stable/c/e8fadbffc19a233d1eedebfb8df0f522d1388280"},{"url":"https://git.kernel.org/stable/c/faebb7ba1ac65fa5810b640df02ce04e509fdc11"}],"title":"accel/amdxdna: Fix use-after-free of mm_struct in job scheduler","x_generator":{"engine":"bippy-1.2.0"}}}}