CVE-2026-68383

What it actually does

Use-after-free in the Xe GPU scheduler where a pointer to an exec queue timeline name remains referenced by pending scheduler fences after the name is freed with the queue, due to mismatched lifetimes.

Why it matters to the business

Local attackers on affected Linux systems can trigger kernel memory corruption, leading to crashes, data exposure, or full system compromise; low exploit maturity but high severity on Xe GPU hardware.

How an attack unfolds

An attacker with local access creates and destroys an exec queue to free the timeline name while scheduler fences still hold references, allowing the dangling pointer to be dereferenced during fence processing for memory corruption.

How to fix it

Apply the upstream kernel patch that stores the timeline name in struct xe_guc_exec_queue to match the RCU-deferred scheduler lifetime; rebuild and reboot with the fixed kernel.

How to confirm the fix worked

Confirm the fix by inspecting the xe_guc_exec_queue structure for the embedded name field and verifying that scheduler fences no longer reference q->name after queue destruction.

Typical attack path

1. Obtain local user access on a Linux system with Xe graphics
2. Trigger creation of a GuC exec queue with a named timeline
3. Destroy the queue to free the name while scheduler fences remain active
4. Force scheduler fence processing to dereference the freed name pointer
5. Exploit the resulting use-after-free for privilege escalation or denial of service

How to detect it

Review kernel logs for use-after-free warnings or oops traces referencing xe_guc_exec_queue or scheduler timeline names; inspect crash dumps for dangling pointer dereferences in GuC fence paths.

What your security team should do

• Prioritize kernel updates on all systems exposing Xe GPUs to untrusted local users
• Monitor for kernel oops or crashes involving drm/xe/guc scheduler code
• Restrict local access on high-risk endpoints until patched