The Linux kernel dma-buf subsystem had a use-after-free vulnerability in the dma_buf_fd() tracepoint. After FD_ADD() returns, the fd is live in the file descriptor table, but a concurrent thread can close it before the tracepoint executes. This close operation frees the dma_buf, causing the tracepoint to dereference a freed object, resulting in a slab use-after-free. The fix reverts the FD_ADD() conversion and splits it into two steps, inserting the tracepoint between them. This approach reserves the fdtable slot with a NULL file pointer during the race window, causing a racing close() to fail safely without freeing the dma_buf, thus preventing the use-after-free.

This vulnerability could lead to kernel memory corruption due to use-after-free, potentially causing system instability or crashes. No information about exploitation in the wild is available. The impact is limited to kernel memory safety and tracepoint operations related to dma-buf file descriptors.

A fix has been implemented in the Linux kernel that reverts the unsafe FD_ADD() usage and inserts the tracepoint safely between get_unused_fd_flags() and fd_install(). Users should update to the fixed kernel versions once available. Patch status is not yet confirmed from vendor advisories; check the official Linux kernel security advisories for current remediation guidance.