CVE-2025-40096

In the Linux kernel, the following vulnerability has been resolved:

drm/sched: Fix potential double free in drmschedjobaddresv_dependencies

When adding dependencies with drmschedjobadddependency(), that function consumes the fence reference both on success and failure, so in the latter case the dmafenceput() on the error path (xarray failed to expand) is a double free.

Interestingly this bug appears to have been present ever since commit ebd5f74255b9 ("drm/sched: Add dependency tracking"), since the code back then looked like this:

drmschedjobaddimplicitdependencies(): ... for (i = 0; i < fencecount; i++) { ret = drmschedjobadddependency(job, fences[i]); if (ret) break; }

   for (; i < fence_count; i++)
           dma_fence_put(fences[i]);

Which means for the failing 'i' the dmafenceput was already a double free. Possibly there were no users at that time, or the test cases were insufficient to hit it.

The bug was then only noticed and fixed after commit 9c2ba265352a ("drm/scheduler: use new iterator in drmschedjobaddimplicitdependencies v2") landed, with its fixup of commit 4eaf02d6076c ("drm/scheduler: fix drmschedjobaddimplicitdependencies").

At that point it was a slightly different flavour of a double free, which commit 963d0b356935 ("drm/scheduler: fix drmschedjobaddimplicit_dependencies harder") noticed and attempted to fix.

But it only moved the double free from happening inside the drmschedjobadddependency(), when releasing the reference not yet obtained, to the caller, when releasing the reference already released by the former in the failure case.

As such it is not easy to identify the right target for the fixes tag so lets keep it simple and just continue the chain.

While fixing we also improve the comment and explain the reason for taking the reference and not dropping it.