Executive brief
The Linux kernel's V3D graphics driver failed to properly track GPU memory objects across job chains, allowing one application's GPU work to read data while another application was still writing it. This could corrupt graphics data or expose sensitive information between processes on systems using V3D-compatible GPUs.
Technical details
A race condition exists in the V3D DRM driver's implicit synchronization mechanism. When a GPU job submission expands into multiple jobs (e.g. bin, render, cache-clean), the buffer object (BO) list was attached only to the final job in the chain. If that final job was a CACHE_CLEAN operation, the consuming job (RENDER/CSD) would have bo_count==0 and acquire no implicit dependencies, allowing it to be dispatched while another context was still writing those objects. The fix attaches BOs to the actual consuming job and adds a per-job has_implicit_dep flag to gate synchronization only on jobs that need it. No authentication is required; any local process with GPU access can trigger the race.
Affected products
- Linux Linux kernel 5.x - 7.x (drm/v3d driver)
Timeline
- 2026-09-17: disclosed: CVE-2026-93047 published on NVD
- 2026-07-10: patched: Upstream fix committed by Maíra Canal
- 2026-09-14: patched: Backported to stable trees