CVE-2026-63910 Linux CVE debrief

Who should care

Linux kernel users and maintainers should be aware of this vulnerability and the subsequent fix to prevent potential UAF issues in dma-buf. This includes operators managing Linux-based systems, platform administrators, vulnerability management teams, and security teams responsible for ensuring system integrity and applying patches.

Technical summary

In the Linux kernel, a vulnerability was found in dma-buf that could lead to a use-after-free (UAF) condition in the dma_buf_fd() tracepoint. The issue arose because the file descriptor was made live in the file descriptor table before the DMA_BUF_TRACE() ran. This allowed a thread sharing the table to close() the fd, which would drop the last reference, causing __fput() to free the dma_buf. The tracepoint then attempted to dereference dmabuf to take dmabuf->name_lock, resulting in a slab-use-after-free error. To fix this, FD_ADD() was split back into get_unused_fd_flags() and fd_install(). The tracepoint was then emitted between these two steps. By reserving the fdtable slot with a NULL file pointer, a racing close() would return -EBADF without entering __fput(), thus keeping the dma_buf alive across the trace. This approach was similar to a previous fix for a UAF in dma_buf_put() tracepoint.

Defensive priority

Medium

Recommended defensive actions

• Apply the kernel patch that splits FD_ADD() into get_unused_fd_flags() and fd_install()
• Emit the dma_buf_fd() tracepoint between get_unused_fd_flags() and fd_install()
• Ensure Linux kernel versions are up to date with the latest security patches
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-19T16:17:08.857Z and has not been modified since then. The NVD entry is currently Received. Evidence is limited to public CVE and NVD data. Defensive verification tasks include reviewing official advisories, checking system patch levels, and monitoring for unusual dma-buf activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.