Executive brief
A vulnerability in the Linux kernel's VideoCore VI (v3d) graphics driver could allow a local user to trigger unintended hardware behavior. When a compute shader is requested with a workgroup size of zero, the hardware incorrectly interprets this as a very large number instead of doing nothing. This could lead to system instability or unexpected processing loads on the graphics hardware.
Technical details
The vulnerability exists in the drm/v3d driver within the Linux kernel. Compute shader dispatches encode workgroup counts in CFG0..CFG2 registers; however, the hardware interprets a value of 0 as 65536, exceeding the driver's maximum exposed limit of 65535. This occurs primarily through indirect CSD jobs where workgroup counts are read from an indirect buffer at runtime. An attacker or malicious application could submit a job with zeroed dimensions to trigger an invalid large-scale dispatch instead of a no-op. The fix involves validating workgroup counts in v3d_csd_job_run and ensuring jobs with zeroed dimensions are skipped.
Affected products
- Linux Linux Kernel 5.3 to 6.18.36, 7.0.13
Timeline
- 2026-06-25: advisory: NVD publication date
- 2026-06-19: patched: Fix committed to stable branches by Greg Kroah-Hartman