Linux Kernel EUVD-2026-93171

Requires local access to a kernel interface that exposes dma_fence objects (e.g., DRM/GPU, sync_file, or other DMA-buf consumers) and the ability to read a fence's timeline name or driver name string concurrently with the fence being signaled. The flaw only manifests for dma_fence implementations that implement a release or wait callback (so the ops pointer is NOT cleared on free), and exploitation hinges on winning the race window between signaling and the RCU-protected string read. Limiting factors: local-only attack vector (no remote reachability), a required low-privilege local account with device access, and race-condition timing that reduces reliability; patched kernels are not affected.

This is a locally-exploitable use-after-free in the Linux kernel's dma-buf/dma-fence subsystem, triggered when the RCU protection for a fence's timeline/driver-name string is lost after signaling because the ops pointer is not cleared for many dma_fence implementations. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H, 7.1) scores it HIGH with high confidentiality and availability impact, consistent with a UAF that can leak kernel memory or crash the system; however, the Tags label it only 'Denial Of Service,' which understates the C:H confidentiality dimension the vector asserts. All exploitation-probability signals point LOW: EPSS is 0.16% (5th percentile), the CVE is NOT in CISA KEV, and no public exploit code is referenced - so there is no public exploit identified at time of analysis. Realistically this is a HIGH-CVSS but LOW-real-world-priority issue: exploitation requires local access with some privilege plus winning a signaling race window, and these dma-fence regressions are typically patched routinely through stable-tree updates rather than attacked opportunistically. One caveat: the flaw is a race condition (UAF after signaling), which the input CVSS rates AC:L - a race window more plausibly warrants AC:H, suggesting reliable exploitation is harder than the base score implies. No SSVC decision data was provided in the input.

A local low-privileged user with access to a DMA-buf/dma-fence interface (e.g., via a GPU or media device node) repeatedly triggers fence signaling while concurrently reading the fence's timeline or driver name string, racing to dereference the string after the backing object is freed. Winning this race yields a kernel use-after-free that can disclose kernel memory contents or crash the system. No public proof-of-concept exploit is identified at time of analysis, and reliable exploitation depends on timing the race precisely.