{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.105-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.6-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux-6.12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.107-1~deb12u1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  drm/xe: Hold a dma-buf reference for imported BOs  An imported dma-buf BO is created as a ttm_bo_type_sg BO whose reservation object is the exporter's dma_buf-\u003eresv. The importer, however, only takes a dma-buf reference after a successful dma_buf_dynamic_attach(). Until then nothing keeps the exporter alive, so if the exporter is freed while the BO still references its resv, a later access to that resv is a use-after-free:    Oops: general protection fault, probably for non-canonical address         0x6b6b6b6b6b6b6b9c   Workqueue: ttm ttm_bo_delayed_delete [ttm]   RIP: 0010:mutex_can_spin_on_owner+0x3f/0xc0  This can be reached on two paths:   - dma_buf_dynamic_attach() fails, or  - ttm_bo_init_reserved() fails during BO creation.  In both cases the BO already has bo-\u003ebase.resv pointing at the exporter resv, and sg BOs are always torn down via ttm_bo_delayed_delete(), which locks bo-\u003ebase.resv asynchronously - potentially after the exporter has been freed.  Take the dma-buf reference in xe_bo_init_locked(), before ttm_bo_init_reserved(), so it also covers a creation failure there, and release it in xe_ttm_bo_destroy(). The reference is held for the whole BO lifetime, keeping the shared resv alive on every path.  v2:   - Reworked the fix to avoid creating the imported sg BO before     dma_buf_dynamic_attach() succeeds.   - Attach with importer_priv == NULL and make invalidate_mappings ignore     incomplete imports.  v3:   - Dropped the xe-side reordering approach since importer_priv must be     valid when dma_buf_dynamic_attach() publishes the attachment.   - Per Christian's suggestion on the v1 thread, keyed the check on     import_attach rather than removing the sg guard entirely.   - Fixes both xe and amdgpu in a single TTM patch.  v4:   - Moved import_attach check to after dma_resv_copy_fences() so fences     are copied before returning for successful imports (Thomas).   - Removed exporter-alive claim from commit message (Thomas).  v5:   - Add drm/xe patch to keep imported sg BOs off the LRU before attach     succeeds; the TTM fix alone is not sufficient for xe if the BO is     already LRU-visible. (Thomas)     v4 patch:     https://patchwork.freedesktop.org/patch/736663/?series=169129\u0026rev=2   - Patch 1 (drm/ttm) carries Christian's Reviewed-by from v4.  v6:   - Reworked the fix based on Thomas' suggestion. Instead of the TTM resv     individualization (v1-v5) plus the xe off-LRU/placement handling (v5),     just hold a dma-buf reference for the imported BO lifetime so the     shared resv can never be freed while the BO still references it.     Single xe patch, no TTM change. (Thomas)   - Take the reference in xe_bo_init_locked() before ttm_bo_init_reserved()     so a TTM creation failure is covered too (Thomas).   - Dropped the v5 series (drm/ttm + drm/xe off-LRU); the off-LRU approach     also regressed in CI BAT via ttm_bo_pipeline_gutting() creating a ghost     BO that outlived the exporter.     Link to v5: https://patchwork.freedesktop.org/series/169984/  v7:   - Move changelog above --- so it stays in the commit message.   - Reorder changelog entries oldest-to-newest. (Thomas)  (cherry picked from commit 3516f3fae6be35642f8f06f8a218da6425c0306a)",
  "id": "DEBIAN-CVE-2026-68266",
  "modified": "2026-09-19T21:47:26.868910354Z",
  "published": "2026-08-10T13:20:15.493Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-68266"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-68266"
  ]
}