CVE-2026-63910

In the Linux kernel, the following vulnerability has been resolved:

dma-buf: fix UAF in dmabuffd() tracepoint

Once FDADD() returns, the fd is live in the file descriptor table and a thread sharing that table can close() it before DMABUF_TRACE() runs. The close drops the last reference, __fput() frees the dmabuf, and the tracepoint then dereferences dmabuf to take dmabuf->namelock -- slab-use-after-free.

Split FDADD() back into getunusedfdflags() + fd_install() and emit the tracepoint between them. While the fdtable slot is reserved with a NULL file pointer, a racing close() returns -EBADF without entering _fput(), so the dmabuf stays alive across the trace. Same approach as commit 2d76319c4cbb ("dma-buf: fix UAF in dmabufput() tracepoint").

This undoes the FDADD() conversion done in commit 34dfce523c90 ("dma: convert dmabuffd() to FDADD()"); FD_ADD() has no place to hook the tracepoint safely.