In the Linux kernel, the following vulnerability has been resolved:
drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies
When adding dependencies with drm_sched_job_add_dependency(), that function consumes the fence reference both on success and failure, so in the latter case the dma_fence_put() on the error path (xarray failed to expand) is a double free.
Interestingly this bug appears to have been present ever since commit ebd5f74255b9 ("drm/sched: Add dependency tracking"), since the code back then looked like this:
drm_sched_job_add_implicit_dependencies(): ... for (i = 0; i < fence_count; i++) { ret = drm_sched_job_add_dependency(job, fences[i]); if (ret) break; }
for (; i < fence_count; i++) dma_fence_put(fences[i]);
Which means for the failing 'i' the dma_fence_put was already a double free. Possibly there were no users at that time, or the test cases were insufficient to hit it.
The bug was then only noticed and fixed after commit 9c2ba265352a ("drm/scheduler: use new iterator in drm_sched_job_add_implicit_dependencies v2") landed, with its fixup of commit 4eaf02d6076c ("drm/scheduler: fix drm_sched_job_add_implicit_dependencies").
At that point it was a slightly different flavour of a double free, which commit 963d0b356935 ("drm/scheduler: fix drm_sched_job_add_implicit_dependencies harder") noticed and attempted to fix.
But it only moved the double free from happening inside the drm_sched_job_add_dependency(), when releasing the reference not yet obtained, to the caller, when releasing the reference already released by the former in the failure case.
As such it is not easy to identify the right target for the fixes tag so lets keep it simple and just continue the chain.
While fixing we also improve the comment and explain the reason for taking the reference and not dropping it.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-abi-stablelistsUpgrade kernel-rt-debug-develUpgrade libperfUpgrade kernel-rt-64k-modulesUpgrade python3-perfUpgrade kernel-uki-virt-addonsUpgrade kernel-docUpgrade kernel-develUpgrade kernel-modulesUpgrade perfUpgrade kernel-headersUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-devel-matchedUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-64k-debug-modules-extraUpgrade kernel-tools-libs-develUpgrade kernel-zfcpdump-develUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-modules-extraUpgrade kernel-64k-debug-modules-coreUpgrade kernel-modules-coreUpgrade kernel-uki-virtUpgrade kernel-rt-debug-modules-coreUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-coreUpgrade kernel-toolsUpgrade kernel-rt-64k-modules-extraUpgrade kernel-64k-debugUpgrade kernel-64k-devel-matchedUpgrade kernel-rt-64k-debug-coreUpgrade kernel-64k-modules-extraUpgrade kernel-debug-uki-virtUpgrade kernel-64k-debug-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-64k-develUpgrade kernel-rt-debug-modulesUpgrade kernel-debug-coreUpgrade kernel-rt-64k-debug-develUpgrade kernel-debug-modules-extraUpgrade bpftoolUpgrade kernel-64k-debug-modulesUpgrade kernel-debug-modules-coreUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-rt-64k-debugUpgrade kernelUpgrade kernel-rt-debugUpgrade kernel-64kUpgrade kernel-rt-64k-coreUpgrade kernel-zfcpdumpUpgrade kernel-64k-coreUpgrade rtlaUpgrade kernel-modules-extraUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-64k-modules-coreUpgrade kernel-rt-develUpgrade rvUpgrade kernel-debug-develUpgrade kernel-64k-debug-develUpgrade kernel-rt-modules-extraUpgrade kernel-debugUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-64k-modulesUpgrade kernel-rtUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-coreUpgrade kernel-cross-headersUpgrade kernel-rt-modules-coreUpgrade kernel-tools-libsUpgrade kernel-rt-64k-modules-coreUpgrade kernel-rt-64kUpgrade kernel-rt-debug-coreUpgrade kernel-debug-modulesUpgrade kernel-rt-64k-devel | Jan 22, 2026 | Jan 19, 2026 |
| Debian | — | Upgrade linux-6.1Upgrade linux | Nov 13, 2025 | Nov 13, 2025 |
| Oracle_linux | — | Upgrade kernelUpgrade kernel-uek | Dec 11, 2025 | Oct 30, 2025 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Jan 20, 2026 | Oct 30, 2025 |
| Rocky_linux | — | Upgrade kernel-debug-develUpgrade kernel-zfcpdump-develUpgrade kernel-modules-extraUpgrade kernel-rt-debug-modulesUpgrade libperfUpgrade kernel-modules-coreUpgrade perf-debuginfoUpgrade kernel-rt-debuginfo-common-x86_64Upgrade python3-perfUpgrade kernel-debug-uki-virtUpgrade kernel-rt-debug-kvmUpgrade kernel-tools-debuginfoUpgrade kernel-rt-coreUpgrade kernel-debuginfo-common-x86_64Upgrade python3-perf-debuginfoUpgrade kernel-rt-debug-develUpgrade kernelUpgrade kernel-uki-virtUpgrade rtlaUpgrade kernel-tools-libsUpgrade kernel-debuginfoUpgrade kernel-coreUpgrade kernel-debugUpgrade kernel-rt-debugUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-debug-coreUpgrade kernel-develUpgrade kernel-modulesUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-zfcpdump-modulesUpgrade kernel-debug-devel-matchedUpgrade kernel-debuginfo-common-s390xUpgrade kernel-debug-modules-extraUpgrade kernel-toolsUpgrade kernel-rt-modules-coreUpgrade rvUpgrade bpftool-debuginfoUpgrade kernel-debug-modulesUpgrade kernel-tools-libs-develUpgrade bpftoolUpgrade libperf-debuginfoUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-debug-coreUpgrade kernel-debug-debuginfoUpgrade kernel-rt-kvmUpgrade kernel-rt-debug-modules-coreUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-zfcpdumpUpgrade kernel-rt-develUpgrade kernel-devel-matchedUpgrade perfUpgrade kernel-uki-virt-addonsUpgrade kernel-rt-debuginfoUpgrade kernel-debug-modules-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rtUpgrade kernel-rt-modules-extra | Jan 26, 2026 | Jan 24, 2026 |
| Suse | — | Upgrade kernel-default-baseUpgrade reiserfs-kmp-defaultUpgrade kernel-defaultUpgrade kernel-symsUpgrade kernel-64kb-develUpgrade kernel-64kbUpgrade kernel-default-develUpgrade kernel-develUpgrade kernel-macrosUpgrade kernel-zfcpdumpUpgrade kernel-docsUpgrade kernel-default-extraUpgrade kernel-sourceUpgrade kernel-obs-build | Dec 5, 2025 | Nov 11, 2025 |
| Ubuntu | — | Upgrade linux-image-6.8.0-1049-nvidiaUpgrade linux-image-generic-64kUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-6.17.0-1011-oemUpgrade linux-image-6.8.0-1048-gke-64kUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-oem-22.04Upgrade linux-image-6.8.0-1048-gkeUpgrade linux-image-oem-22.04aUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-virtualUpgrade linux-image-6.8.0-1052-gcp-fipsUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-6.8.0-1035-gkeopUpgrade linux-image-generic-lpaeUpgrade linux-image-fips-6.8Upgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-6.17.0-1007-oracleUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-raspi-realtimeUpgrade linux-image-raspi-realtime-6.8Upgrade linux-image-azure-6.17Upgrade linux-image-ibm-6.8Upgrade linux-image-6.8.0-1049-ibmUpgrade linux-image-aws-fipsUpgrade linux-image-6.17.0-1006-realtimeUpgrade linux-image-6.8.0-1050-awsUpgrade linux-image-ibm-classicUpgrade linux-image-intel-iotgUpgrade linux-image-lowlatencyUpgrade linux-image-6.17.0-1007-aws-64kUpgrade linux-image-aws-6.17Upgrade linux-image-fipsUpgrade linux-image-nvidiaUpgrade linux-image-6.17.0-1007-gcpUpgrade linux-image-azure-fips-6.8Upgrade linux-image-generic-6.17Upgrade linux-image-aws-64kUpgrade linux-image-oracleUpgrade linux-image-6.8.0-1052-gcp-64kUpgrade linux-image-azure-6.8Upgrade linux-image-6.17.0-1007-gcp-64kUpgrade linux-image-6.8.0-106-generic-64kUpgrade linux-image-xilinxUpgrade linux-image-gcp-6.8Upgrade linux-image-6.8.0-1051-azureUpgrade linux-image-lowlatency-64kUpgrade linux-image-6.8.0-106-genericUpgrade linux-image-oracle-64k-6.8Upgrade linux-image-azure-lts-24.04Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-6.8.1-1045-realtimeUpgrade linux-image-6.8.0-1050-raspiUpgrade linux-image-generic-6.8Upgrade linux-image-6.17.0-14-generic-64kUpgrade linux-image-6.17.0-1008-azureUpgrade linux-image-ibmUpgrade linux-image-lowlatency-6.8Upgrade linux-image-gkeop-6.8Upgrade linux-image-oracle-6.17Upgrade linux-image-gkeopUpgrade linux-image-6.8.0-1050-aws-64kUpgrade linux-image-gcpUpgrade linux-image-6.8.0-1047-oracleUpgrade linux-image-genericUpgrade linux-image-nvidia-64kUpgrade linux-image-realtime-hwe-22.04Upgrade linux-image-intel-iot-realtimeUpgrade linux-image-6.8.0-1029-xilinxUpgrade linux-image-aws-lts-24.04Upgrade linux-image-6.8.0-1049-nvidia-lowlatencyUpgrade linux-image-6.8.0-1047-oracle-64kUpgrade linux-image-6.17.0-1007-oracle-64kUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-6.8.0-106-fipsUpgrade linux-image-6.17.0-1007-awsUpgrade linux-image-aws-6.8Upgrade linux-image-6.17.0-1008-raspiUpgrade linux-image-raspiUpgrade linux-image-gcp-64kUpgrade linux-image-oem-6.17Upgrade linux-image-azure-fipsUpgrade linux-image-6.8.0-1049-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1049-nvidia-64kUpgrade linux-image-realtime-6.8.1Upgrade linux-image-6.17.0-14-genericUpgrade linux-image-gcp-64k-6.17Upgrade linux-image-aws-64k-6.17Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-kvmUpgrade linux-image-aws-fips-6.8Upgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-aws-64k-6.8Upgrade linux-image-6.8.0-1052-gcpUpgrade linux-image-6.8.0-1050-aws-fipsUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-azureUpgrade linux-image-oem-22.04cUpgrade linux-image-6.8.0-1052-azure-fipsUpgrade linux-image-raspi-6.17Upgrade linux-image-oracle-64k-6.17Upgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-gcp-fipsUpgrade linux-image-oem-22.04dUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-gke-64kUpgrade linux-image-oracle-64kUpgrade linux-image-virtual-6.8Upgrade linux-image-realtime-6.17Upgrade linux-image-oem-22.04bUpgrade linux-image-awsUpgrade linux-image-gkeUpgrade linux-image-realtimeUpgrade linux-image-6.8.0-106-lowlatencyUpgrade linux-image-oracle-6.8Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-generic-64k-6.17Upgrade linux-image-gke-64k-6.8Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-gke-6.8Upgrade linux-image-gcp-fips-6.8Upgrade linux-image-nvidia-6.8Upgrade linux-image-xilinx-6.8Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-virtual-6.17Upgrade linux-image-raspi-6.8Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-generic-64k-6.8Upgrade linux-image-gcp-64k-6.8Upgrade linux-image-gcp-6.17Upgrade linux-image-6.8.0-2040-raspi-realtimeUpgrade linux-image-6.8.0-106-lowlatency-64k | Feb 13, 2026 | Feb 12, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Feb 9, 2026 | Oct 30, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub