CVE-2026-68380
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In the Linux kernel, the accel/amdxdna driver has a use-after-free vulnerability of the mm_struct in the job scheduler. The pointer to mm_struct is stored without holding a reference, which can lead to access to freed memory during job execution.
Risk Assessment
This could lead to system crashes or potentially to privilege escalation, posing a serious security threat.
Recommendation
Apply a Linux kernel update containing the fix that uses mmgrab() to hold a reference for the job's lifetime and mmdrop() in cleanup paths.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix use-after-free of mm_struct in job scheduler amdxdna_cmd_submit() stores current->mm in job->mm without holding any reference. aie2_sched_job_run() later access job->mm from the DRM scheduler worker thread. With only a raw pointer and no structural reference, the mm_struct can be freed before the scheduler runs the job. Fix this by calling mmgrab() to hold a structural mm_count reference for the lifetime of the job, paired with mmdrop() in every cleanup path.