What’s Vulnerable › Vulnerabilities

CVE-2026-68383: drm/xe/guc: Keep scheduler timeline name alive

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-10 · updated 2026-10-21
• Weakness: CWE-416

Description

In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Keep scheduler timeline name alive The scheduler keeps a pointer to the timeline name, but q->name is freed with the exec queue while scheduler fences can still reference it. Store the name in struct xe_guc_exec_queue so it shares the scheduler's RCU-deferred lifetime. (cherry picked from commit 41075f0eb5dcbd3b065d15f15ef7bbe9315188e8)

Affected products

• Linux kernel: from 6.12.43 before 6.12.114; from 6.15.11 before 6.16; from 6.16.2 before 6.17; 6.17 — fixed in 6.12.114, 6.16, 6.17, 7.2

How to fix

Upgrade to a fixed version: Linux kernel 6.12.114, 6.16, 6.17, 7.2. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/299bc6d50b1bed7d1f408391736712f01a0855e2
• https://git.kernel.org/stable/c/77fd62412431e8c80ef2ad61466bc76fe425f80a
• https://git.kernel.org/stable/c/88c38ff74f8345fcf8852549f94025754019b037
• https://git.kernel.org/stable/c/eac2839585741e6c1b4af261a0b58bca0d6f5436

Get alerted when CVE-2026-68383 or the next vulnerability affects your stack