CVE-2026-93058

What it actually does

Use-after-free in drm/msm ringbuffer creation when drm_sched_init fails partway through; the error path invokes drm_sched_fini on an incompletely initialized scheduler, freeing or accessing uninitialized work items, lists, and workqueue state.

Why it matters to the business

Systems using the MSM graphics driver (common on Qualcomm-based devices) risk kernel crashes, memory corruption, or local privilege escalation; widespread Linux distributions and embedded devices are affected until patched kernels are deployed.

How an attack unfolds

An attacker with local access triggers a deliberate failure in drm_sched_init (for example via resource exhaustion or crafted parameters) so that the subsequent call to drm_sched_fini operates on a partially constructed scheduler object, resulting in a use-after-free that can be leveraged for arbitrary kernel code execution.

How to fix it

Update to a Linux kernel containing the fix that records successful drm_sched_init completion and only invokes drm_sched_fini on fully initialized objects; rebuild and reboot with the corrected kernel.

How to confirm the fix worked

Inspect the msm_ringbuffer source for the added success-tracking flag and conditional drm_sched_fini call; confirm the patch is present via kernel version or source diff and verify no partial-init paths remain.

Typical attack path

1. Obtain local unprivileged access on a Linux system with the MSM DRM driver loaded
2. Trigger allocation or scheduler setup failure inside msm_ringbuffer_new
3. Force execution of the error path that unconditionally calls drm_sched_fini
4. Exploit the resulting use-after-free for memory corruption or privilege escalation

How to detect it

Review kernel crash logs and dmesg for MSM scheduler teardown errors or use-after-free reports; examine audit logs for unusual local process activity targeting graphics device nodes around the time of a crash.

What your security team should do

• Prioritize kernel updates on all systems exposing the MSM DRM driver
• Monitor vendor advisories for backported fixes in distribution kernels
• Restrict unprivileged local access where feasible until patches are applied
• Reboot affected hosts after kernel upgrade to load the corrected module