DRM scheduler fence UAF still open after two driver CVEs

A use-after-free in the DRM GPU scheduler’s fence timeline name path remains reachable from unprivileged userspace, even after two recent driver-specific CVEs closed the same class of bug in Intel’s xe and Arm’s panthor stacks.

Jonghyuk Kim reported that drm_sched’s get_timeline_name callback still walks a pointer into the scheduler object. Drivers that allocate a scheduler per context, queue, or VM free that object when the context goes away, but a finished fence exported through a sync_file or drm_syncobj can outlive it. A later SYNC_IOC_FILE_INFO query then reads freed memory. Kim named amdxdna, nouveau, and msm’s VM_BIND path as still exposed in mainline, and framed the defect as the same pattern as CVE-2025-38703 and CVE-2025-71302.

Kim’s fourth revision tried a minimal core fix: cache the timeline name string when the fence is created and never touch the scheduler again from that callback, plus a KUnit regression test under KASAN and a TODO for eventually detaching fence ops on signal. That approach did not survive review.

Christian König argued that caching only moves the lifetime problem onto the name string, which drivers are not prepared to keep alive for every userspace-held fence. Philipp Stanner and others noted that panthor already allocates and frees its timeline name dynamically, so a cached pointer can dangle the same way. Detaching fence ops on signal, presented as a longer-term cleanup, was also disputed: König said ops detach is meant to unbind a fence from its producing module, not to paper over scheduler-versus-driver object lifetimes.

Discussion then shifted toward the dma-fence helpers themselves. After an earlier change, driver-name and timeline-name lookups key off whether ops are still attached rather than whether the fence is signaled. Because drm_sched fences keep a release callback, their ops stay live after signal, so userspace can still invoke producer callbacks against a scheduler that is already gone. Kim agreed the caching patch and the TODO should be dropped pending a clearer direction, and maintainers are weighing whether the helpers need both an ops check and a signaled check, or whether drivers need a way to wait until finished fences are fully drained before tearing down a scheduler.

Until that lands, the core path remains a shared footgun for any driver that tears down per-context schedulers while fences may still be held in userspace.