Executive brief
A vulnerability in the Linux kernel's V3D graphics driver could allow a local user to crash the system or cause it to become unresponsive. By providing a specially crafted data structure to the driver, an attacker can force the system into an infinite loop that consumes all available processing power on a CPU core. This results in a denial-of-service condition, impacting the availability of the affected machine.
Technical details
The vulnerability exists in the v3d_get_extensions() function within the Linux kernel's DRM V3D driver. The function iterates through a userspace-provided singly-linked list of ioctl extensions without sufficient validation of the chain's structure or length. A local attacker can provide a self-referential extension (where the next pointer points to itself) with both in_sync_count and out_sync_count set to zero. Because these counts are zero, the driver's internal duplicate-extension guard is bypassed, leading to an infinite loop in kernel context. This pegs a CPU core at 100% usage and blocks the calling thread indefinitely. The fix involves rejecting multisync extensions where both sync counts are zero.
Affected products
- Linux Linux Kernel v3d driver
Timeline
- 2026-04-15: disclosed: Initial patch submitted by researcher
- 2026-05-23: patched: Patch committed to stable tree
- 2026-06-08: advisory: CVE-2026-46314 published