Linux Kernel CVE-2026-63910

The flaw lives in the DMA buffer sharing framework (dma-buf), the kernel's mechanism for sharing buffers across drivers and subsystems (notably GPU/DRM, V4L2/media, and other zero-copy paths) exposed to userspace as file descriptors. The regression was introduced by commit 34dfce523c90 which converted dma_buf_fd() to the FD_ADD() helper; FD_ADD() atomically publishes the fd into the descriptor table but provides no safe hook point between reservation and installation to emit the tracepoint. The root cause is a classic use-after-free (CWE-416) driven by a time-of-use race: once the fd is live, a concurrent close() drops the last reference, __fput() frees the dma_buf, and the still-running tracepoint reads freed slab memory. The fix splits FD_ADD() back into get_unused_fd_flags() + fd_install() and emits the tracepoint while the fdtable slot is reserved with a NULL file pointer, so a racing close() returns -EBADF without entering __fput(), mirroring the earlier fix in commit 2d76319c4cbb for the dma_buf_put() tracepoint.