Executive brief
A technical issue was identified in the Linux kernel's V3D graphics driver, primarily affecting devices like the Raspberry Pi 5. The system was failing to correctly declare the maximum data size it could handle at once, leading to internal kernel warnings and potential instability during heavy graphics rendering. This has been resolved by correctly configuring the driver's memory management settings.
Technical details
A vulnerability (or functional bug) was identified in the drm/v3d driver where the DMA 'max_seg_size' was not explicitly initialized, causing it to default to the kernel's 64K limit. When V3D rendering attempted to map scatter-gather (sg) segments longer than this default (e.g., ~8MB), the kernel would trigger a WARNING in 'debug_dma_map_sg' if CONFIG_DMA_API_DEBUG was enabled. This could lead to over-mapping issues or driver instability. The fix involves calling 'dma_set_max_seg_size' with UINT_MAX during the platform DRM probe to accommodate larger segments required by the V3D hardware.
Affected products
- Linux Linux Kernel 6.12.53-yocto-standard; versions prior to fix in 6.1, 6.6, 6.11, 6.12, 6.13
Timeline
- 2025-12-03: other: Patch submitted by developer
- 2026-03-04: patched: Commits merged into stable branches
- 2026-05-08: disclosed: CVE published
References
- https://git.kernel.org/stable/c/0290934d30abe7c88e18140fd5184c3f386b1e44
- https://git.kernel.org/stable/c/14d0d6c8b4504a60cfeea74775ab2e0164019e65
- https://git.kernel.org/stable/c/225023e3619b81af6d8d0e680503fc2d68633023
- https://git.kernel.org/stable/c/2663ef70c6123b2232190f917275e5c3175f97d0
- https://git.kernel.org/stable/c/9eb018828b1b30dfba689c060735c50fc5b9f704
- https://git.kernel.org/stable/c/cf510785f74e74c54de40a43a955b7f844857487
- https://git.kernel.org/stable/c/db15f469a88d3bbeeaa9f8c9f5e74d856ba5d7d2