Executive brief
The Linux kernel's DRM v3d graphics driver fails to validate a user-supplied buffer object handle before dereferencing it in indirect compute shader dispatch (CSD) job setup. An attacker with local access can supply an invalid or stale handle, causing the kernel to attempt a null pointer dereference when the job executes, resulting in a kernel crash and denial of service.
Technical details
The vulnerability is a null pointer dereference in the v3d_get_cpu_indirect_csd_params() function in drivers/gpu/drm/v3d/v3d_submit.c. The function looks up an indirect buffer object from a userspace-supplied handle using drm_gem_object_lookup() but never validates the return value. A bogus or stale handle causes the lookup to return NULL, which is then stored in info->indirect and dereferenced later when the indirect CSD job runs. The fix adds a null check immediately after the lookup and returns -ENOENT if it fails, rejecting the bad handle at submission time. Attack vector is local (requires direct access to DRM device file), and no authentication or user interaction is required. The patch was applied beginning in kernel 6.x releases.
Affected products
- Linux Linux kernel multiple stable branches