CVE-2026-74638

A flaw was found in the Linux kernel's drm/v3d driver. This vulnerability arises from concurrent handling of scheduler timeout events across different hardware queues, which share a single global reset mechanism. When a reset occurs in one queue while another is processing a timeout, the...

CVE-2026-74638

CVE-2026-74638 affects the V3D DRM scheduler in the Linux kernel, used on hardware such as the Raspberry Pi 5 . The V3D GPU exposes multiple independent hardware queues (BIN, RENDER, TFU, CSD) but performs only a single global reset . When a timeout on one queue triggers a global reset while anot...

CVE-2026-74638 drm/v3d: Serialize the scheduler timeout handlers

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Serialize the scheduler timeout handlers V3D exposes several independent hardware queues BIN, RENDER, TFU and CSD but has only a single, global reset. A timeout on any one queue therefore has to stop, reset and restart t...

CVE-2026-74638 drm/v3d: Serialize the scheduler timeout handlers

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Serialize the scheduler timeout handlers V3D exposes several independent hardware queues BIN, RENDER, TFU and CSD but has only a single, global reset. A timeout on any one queue therefore has to stop, reset and restart t...

CVE-2026-72327

A flaw was found in the Linux kernel's drm/v3d component. The v3dgetcpuindirectcsdparams function does not properly validate a userspace-supplied indirect buffer object BO handle. An attacker, by providing a bogus or stale handle, can cause a NULL pointer dereference. This can lead to a system...

Linux Distros Unpatched Vulnerability : CVE-2026-72327

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/v3d: Reject invalid indirect BO handle in indirect CSD setup v3dgetcpuindirectcsdparams looks up the indirect buffer object from a userspace-supplied handle...

The vulnerability of DRM/V3D components in Linux operating systems allows a perpetrator to trigger a service failure.

The vulnerability of DRM/V3D components in the Linux operating system is related to incorrect calculation of buffer sizes. Exploiting this vulnerability can allow a perpetrator to cause service interruptions...

CVE-2026-72327

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Reject invalid indirect BO handle in indirect CSD setup v3dgetcpuindirectcsdparams looks up the indirect buffer object from a userspace-supplied handle but never checks the result. A bogus or stale handle makes...

CVE-2026-72327 drm/v3d: Reject invalid indirect BO handle in indirect CSD setup

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Reject invalid indirect BO handle in indirect CSD setup v3dgetcpuindirectcsdparams looks up the indirect buffer object from a userspace-supplied handle but never checks the result. A bogus or stale handle makes...

CVE-2026-72327 drm/v3d: Reject invalid indirect BO handle in indirect CSD setup

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Reject invalid indirect BO handle in indirect CSD setup v3dgetcpuindirectcsdparams looks up the indirect buffer object from a userspace-supplied handle but never checks the result. A bogus or stale handle makes...

EUVD-2026-59226

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Reject invalid indirect BO handle in indirect CSD setup v3dgetcpuindirectcsdparams looks up the indirect buffer object from a userspace-supplied handle but never checks the result. A bogus or stale handle makes...

SUSE CVE-2026-64099

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Fix use-after-free of CPU job query arrays on error path The CPU job ioctl's fail label calls kvfree on cpujob's timestamp and performance query arrays after v3djobcleanup, which drops the job's last reference and frees...

CVE-2026-64099

A flaw was found in the Linux kernel's drm/v3d graphics driver. This vulnerability, a use-after-free error, occurs in the CPU job input/output control ioctl error path. When an error is encountered, the system attempts to access memory that has already been freed, which can lead to system...

EUVD-2026-45784

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Fix use-after-free of CPU job query arrays on error path The CPU job ioctl's fail label calls kvfree on cpujob's timestamp and performance query arrays after v3djobcleanup, which drops the job's last reference and frees...

CVE-2026-64099 drm/v3d: Fix use-after-free of CPU job query arrays on error path

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Fix use-after-free of CPU job query arrays on error path The CPU job ioctl's fail label calls kvfree on cpujob's timestamp and performance query arrays after v3djobcleanup, which drops the job's last reference and frees...

CVE-2026-64099 drm/v3d: Fix use-after-free of CPU job query arrays on error path

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Fix use-after-free of CPU job query arrays on error path The CPU job ioctl's fail label calls kvfree on cpujob's timestamp and performance query arrays after v3djobcleanup, which drops the job's last reference and frees...

CVE-2026-64099

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Fix use-after-free of CPU job query arrays on error path The CPU job ioctl's fail label calls kvfree on cpujob's timestamp and performance query arrays after v3djobcleanup, which drops the job's last reference and frees...

PT-2026-61416

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the drm/v3d component. In the CPU job ioctl error path, the system calls kvfree on timestamp and performance query arrays after v3d job cleanup has alrea...

Linux Distros Unpatched Vulnerability : CVE-2026-53139

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/v3d: Skip CSD when it has zeroed workgroups A compute shader dispatch encodes its workgroup counts in the CFG0..CFG2 registers. Kicking off a dispatch with ...

Linux Distros Unpatched Vulnerability : CVE-2026-53140

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups v3drewritecsdjobwgcountsfromindirect maps both the indirect buffer and the workgroup buffer and ...