Executive brief
The Linux kernel's V3D graphics driver contains a memory safety bug where job scheduling callbacks fail to clear a dangling pointer when fence creation fails. This can lead to use-after-free conditions and potential system instability or denial of service when the graphics hardware is in use.
Technical details
The vulnerability is a use-after-free / dangling pointer issue in the V3D GPU scheduler. The run_job() callbacks for BIN, RENDER, TFU, and CSD job queues assign the incoming job to queue->active_job before attempting to create a DMA fence via v3d_fence_create(). If fence creation fails, the callbacks return NULL without clearing the active_job pointer, leaving a dangling reference to freed memory. Subsequent code may dereference this stale pointer, causing a use-after-free condition. The fix introduces explicit error paths that clear active_job before returning on failure; the BIN path uses queue_lock synchronization while RENDER, TFU, and CSD paths clear it lock-free. No user interaction or authentication is required; an unprivileged local user with GPU access can trigger fence allocation failures.
Affected products
- Linux Linux kernel affected versions include multiple stable branches from linux-5.x through linux-7.x
Timeline
- 2026-09-17: disclosed
- 2026-06-04: patched: Original patch commit 25a1669907512e927fab9ad4d4fb74ff57f63cd9
- 2026-09-14: other: Backport to stable kernels commit 0b9878aba5cf93bc2b55ba9eb807757ce3239bec