CVE-2026-68266

CVE-2026-68266 is a use-after-free in the Xe GPU driver's buffer object handling, but understanding what actually happened requires looking beyond the CVE description. The bug stems from a lifecycle mismatch: Xe creates a BO referencing an exporter's reservation object before dma-buf attach succeeds, while TTM's asynchronous deletion path (delayed_delete workqueue) can touch that reservation after the exporter has already been freed. No amount of operation reordering closes this timing gap. The six-patch fix history is the real diagnostic evidence. Versions 2 through 5 attempted various reordering strategies—each failed or regressed. The v5 approach (off-LRU guard plus TTM resv individualization) actually introduced ghost BOs via ttm_bo_pipeline_gutting() that outlived the exporter. This regression exposed something the CVE description doesn't capture: TTM's internal teardown path runs on assumptions about object graph completeness that no single-driver fix can fully encode. The final v6 solution—holding a dma-buf reference for the BO's entire lifetime—is correct for Xe, but it patches the importer rather than the subsystem. TTM's pipeline_gutting semantics remain an undocumented shared failure surface. This pattern has surfaced in amdgpu, i915, and nouveau historically; each was patched at the driver layer without addressing the underlying TTM assumption. Future GPU drivers hitting this same mismatch will face the same investigation, because the root collision between TTM's async-first design and dma-buf's synchronous attach semantics goes unfixed at the subsystem level. The CVSS 7.8 score measures this instance's exploitability but doesn't reflect the systemic risk: each iteration of 'patch the importer, leave TTM alone' deepens the gap between what TTM's internals actually do and what driver developers can safely assume. If your driver uses ttm_bo_type_sg with imported dma-buf objects, verify that reference lifetimes extend across the entire BO lifetime—the pattern this CVE documents is likely dormant in other drivers that haven't yet triggered the right failure path.

Reviewed through automated stages and approved by a human before publication.