Executive brief
A vulnerability in the Linux kernel's Virtual Kernel Display Driver (VKMS) has been resolved. This component is used to simulate display hardware in environments without physical monitors. The issue involved a custom timer implementation that could lead to system instability or unexpected behavior during display synchronization tasks.
Technical details
This vulnerability stems from the custom hrtimer implementation in the Virtual Kernel Display Driver (VKMS) for handling vblank events. The original implementation in `vkms_crtc.c` manually managed `vblank_hrtimer` and `period_ns` within `struct vkms_output`, which was prone to race conditions and overrun issues (as noted by the `pr_warn` for vblank timer overruns in the original code). The fix migrates VKMS to the standard DRM vblank timer helpers (`DRM_CRTC_VBLANK_TIMER_FUNCS`), which provides a more robust and unified implementation for simulating vertical blanking intervals. This change removes the custom `vkms_enable_vblank`, `vkms_disable_vblank`, and `vkms_get_vblank_timestamp` functions in favor of the DRM core's implementation.
Affected products
- Linux Linux Kernel All versions prior to the fix in drm/vkms
Timeline
- 2025-09-16: disclosed: Initial patch authored
- 2026-06-08: advisory: CVE published by NVD