CVE-2026-98521
En el kernel de Linux se ha resuelto la siguiente vulnerabilidad:
drm/i915: corrige el orden incorrecto de desmontaje de RCU
i915_gem_busy_ioctl utiliza dma_resv_for_each_fence_unlocked() para recorrer los fences de un objeto GEM sin mantener una referencia, sino únicamente el bloqueo de lectura de RCU.
Lo que puede ocurrir aquí es que el objeto GEM se destruya de forma concurrente mientras i915_gem_busy_ioctl sigue en ejecución. Esto no libera la memoria del objeto GEM, pero sí elimina todas las referencias a dma_fence.
Ahora bien, cuando dma_resv_for_each_fence_unlocked() detecta un dma_fence destruido, asume que se ha instalado una nueva lista de fences y reinicia el bucle.
Leer descripción completaMostrar menos
Sin embargo, en el caso de un objeto GEM destruido nunca se instala una nueva lista de fences; solo se libera la anterior, por lo que la iteración nunca termina y se produce un bucle infinito.
La solución consiste en liberar las referencias a los fences únicamente después del periodo de gracia de RCU.
La etiqueta Fixes no corresponde necesariamente al parche que introdujo el problema, sino al que lo agravó hasta el punto de que es necesario abordarlo.
El problema fue señalado por Sashiko-bot.
(cherry picked from commit 5113479556025093bf8133bb2dcaa33be2d50921)
Traducción automática del texto original de NVD (en inglés).
CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días
- 0.21 %
- Percentil entre todas las CVEs puntuadas
- 11
- Fecha de la puntuación
- 20/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
Mostrar las 6 referencias
- https://git.kernel.org/stable/c/2dd0190e397ec6468095fd3e80e79276a7361449
- https://git.kernel.org/stable/c/4d4ca84213327da1f84ef7af3946dea6b14c5d88
- https://git.kernel.org/stable/c/b12e041aedcf9fa77c6002a49f07eb20d0521b86
- https://git.kernel.org/stable/c/c53db9cc245219af6b528ca022a17ebfa91d80ba
- https://git.kernel.org/stable/c/cc890d3f1b15bf6481dc7270fba0b4fbba572813
- https://git.kernel.org/stable/c/d2da6696e0c4e60414706e607029d0bb0330c67e
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-98521",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "912ff2ebd695c582ca4cebf833ad73a378a99f23",
"lessThan": "4d4ca84213327da1f84ef7af3946dea6b14c5d88",
"versionType": "git"
},
{
"status": "affected",
"version": "912ff2ebd695c582ca4cebf833ad73a378a99f23",
"lessThan": "c53db9cc245219af6b528ca022a17ebfa91d80ba",
"versionType": "git"
},
{
"status": "affected",
"version": "912ff2ebd695c582ca4cebf833ad73a378a99f23",
"lessThan": "b12e041aedcf9fa77c6002a49f07eb20d0521b86",
"versionType": "git"
},
{
"status": "affected",
"version": "912ff2ebd695c582ca4cebf833ad73a378a99f23",
"lessThan": "cc890d3f1b15bf6481dc7270fba0b4fbba572813",
"versionType": "git"
},
{
"status": "affected",
"version": "912ff2ebd695c582ca4cebf833ad73a378a99f23",
"lessThan": "2dd0190e397ec6468095fd3e80e79276a7361449",
"versionType": "git"
},
{
"status": "affected",
"version": "912ff2ebd695c582ca4cebf833ad73a378a99f23",
"lessThan": "d2da6696e0c4e60414706e607029d0bb0330c67e",
"versionType": "git"
}
],
"programFiles": [
"drivers/gpu/drm/i915/gem/i915_gem_object.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.17",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/gpu/drm/i915/gem/i915_gem_object.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-10-18T16:17:03.473",
"references": [
{
"url": "https://git.kernel.org/stable/c/2dd0190e397ec6468095fd3e80e79276a7361449",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4d4ca84213327da1f84ef7af3946dea6b14c5d88",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b12e041aedcf9fa77c6002a49f07eb20d0521b86",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c53db9cc245219af6b528ca022a17ebfa91d80ba",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/cc890d3f1b15bf6481dc7270fba0b4fbba572813",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d2da6696e0c4e60414706e607029d0bb0330c67e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915: fix incorrect RCU teardown order\n\ni915_gem_busy_ioctl uses dma_resv_for_each_fence_unlocked() to iterate\nover the fences in an GEM object without holding a reference but only\nthe RCU read side lock.\n\nWhat can happen here is that the GEM object is destroyed concurrently\nwhile i915_gem_busy_ioctl is still running. This won't free the GEM\nobjects memory, but still drops all the dma_fence references.\n\nNow when dma_resv_for_each_fence_unlocked() sees a destroyed dma_fence it\nassumes that a new fence list was installed and re-starts the loop.\n\nBut in the case of a destroyed GEM object a new fence list is never\ninstalled, only the old one freed and therefore the iteration never\nfinishes resulting in an endless loop.\n\nThe solution is to drop the fence references only after the RCU grace\nperiod.\n\nThe fixes tag is not necessary the patch introducing the problem, but the\none making it so worse that we need to address it.\n\nThis problem was pointed out by Sashiko-bot.\n\n(cherry picked from commit 5113479556025093bf8133bb2dcaa33be2d50921)"
}
],
"lastModified": "2026-10-19T10:19:06.040",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}