CVE-2026-74638

drm/v3d: Serialize the scheduler timeout handlers

Published Aug 22, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/v3d: Serialize the scheduler timeout handlers

V3D exposes several independent hardware queues (BIN, RENDER, TFU and
CSD) but has only a single, global reset. A timeout on any one queue
therefore has to stop, reset and restart the schedulers of every other
queue as well. That makes concurrent timeout handlers unsafe.

`reset_lock` was never able to make them safe, as a driver-side lock can
only cover the driver's &drm_sched_backend_ops.timedout_job callback.
The scheduler handles the timed out job and its pending list around that
callback, outside of the driver's control, so a global reset triggered
by one queue can still interfere with another queue that is in the
middle of handling a timeout of its own.

Consequently, if a reset happens in the CSD queue while a CL-intensive
application is running, the global reset stops and restarts the CL
queue's scheduler while that queue is handling a timeout of its own. As
drm_sched_stop() and drm_sched_start() subtract and add the credits of
every job sitting on the pending list of the scheduler they are called
on, and as the CL queue's handler concurrently takes its job off that
same list and puts it back, the stop and the start no longer see the
same set of jobs. The CL queue is left with more credits in flight than
its limit:

[ 327.302739] ------------[ cut here ]------------
[ 327.302744] WARNING: CPU: 2 PID: 43 at drivers/gpu/drm/scheduler/sched_main.c:102 drm_sched_run_job_work+0x238/0x4d0 [gpu_sched]
[ 327.302884] CPU: 2 UID: 0 PID: 43 Comm: kworker/u16:1 Not tainted 6.18.39-v8-16k+ #3 PREEMPT
[ 327.302889] Hardware name: Raspberry Pi 5 Model B Rev 1.0 (DT)
[ 327.302893] Workqueue: v3d_bin drm_sched_run_job_work [gpu_sched]
[ 327.302984] Call trace:
[ 327.302987] drm_sched_run_job_work+0x238/0x4d0 [gpu_sched] (P)
[ 327.302997] process_scheduled_works+0x180/0x3d0
[ 327.303010] worker_thread+0x268/0x3e8
[ 327.303016] kthread+0x140/0x250
[ 327.303022] ret_from_fork+0x10/0x20
[ 327.303031] ---[ end trace 0000000000000000 ]---

From that point on, the credit count of the CL queue is broken, causing
a complete GPU hang and UI freeze.

The DRM scheduler already provides a mechanism to serialize the timeout
handlers of different schedulers: an ordered workqueue passed as
drm_sched_init()'s @timeout_wq parameter. By default, each scheduler
queues its timeout work on the system workqueue, which runs the handlers
concurrently. Give all of the queues a shared ordered workqueue instead,
as recommended by the DRM scheduler documentation for hardware that has
distinct queues but resets globally.

Analysis

Technical impact

The vulnerability in the Linux kernel’s V3D driver arises because concurrent scheduler timeout handlers are not serialized. When a global reset is triggered by any queue, it stops and restarts all other queues’ schedulers without proper locking. This race condition allows one queue to interfere with another’s timeout handling, corrupting the credit bookkeeping and resulting in a GPU hang and UI freeze. The weakness fits the race‑condition category, where unsynchronized access to shared resources leads to an inconsistent system state.

Affected Systems

All Linux kernel builds that include the V3D DRM driver with multiple independent hardware queues are affected. No specific version list is supplied, but the issue could exist in any kernel that has not incorporated the fix for serializing timeout handlers.

Risk and Exploitability

The CVSS score of 5.5 indicates a medium severity. The EPSS score is under 1%, suggesting a low likelihood of exploitation. The vulnerability is a local denial‑of‑service that requires an application with GPU access to trigger a timeout. An attacker who can run GPU‑intensive code could cause a device reset and subsequent crash, impacting system availability. The vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`35e4079bf1a2570abffce6ababa631afcf8ea0e5`	affected	< 5884851a096d8afcdf91f0e542bac193035183a6
`35e4079bf1a2570abffce6ababa631afcf8ea0e5`	affected	< c22a45817b9c92aa0391db60e2ed467c7e6027d7
`35e4079bf1a2570abffce6ababa631afcf8ea0e5`	affected	< 4da94744707b27a3ae1197bdd7127da4505dc5b1
`5235b56b7e5449d990d21d78723b1a5e7bb5738e`	affected	—
`12125f7d9c15e6d8ac91d10373b2db2f17dcf767`	affected	—
`a5f162727b91e480656da1876247a91f651f76de`	affected	—
`422a8b10ba42097a704d6909ada2956f880246f2`	affected	—
`6.1.139`	affected	< 6.2
`6.6.91`	affected	< 6.7
`6.12.29`	affected	< 6.13
`6.14.7`	affected	< 6.15

Linux

affected

Version	Status	Constraints
`6.15`	affected	—
`0`	unaffected	< 6.15
`6.18.45`	unaffected	≤ 6.18.*
`7.1.9`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,5884851a096d8afcdf91f0e542bac193035183a6)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,c22a45817b9c92aa0391db60e2ed467c7e6027d7)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,4da94744707b27a3ae1197bdd7127da4505dc5b1)`	affected	code_commit	—
`[0,6.18.45)`	affected	semver	—
`[0,7.1.9)`	affected	semver	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[6.18.45,6.18.*]`	unaffected	generic	—
`[7.1.9,7.1.*]`	unaffected	generic	—
`[7.2,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Linux kernel to a release that includes the V3D scheduler timeout serialization fix.
If a kernel update is not immediately possible, disable or restrict use of the V3D driver on systems where it is not essential to reduce the attack surface.
Enable kernel logging for DRM scheduler events and monitor for ‘drm_sched_run_job_work’ warnings; restart the GPU or reboot the system if a hang occurs.

Generated by OpenCVE AI on August 24, 2026 at 20:43 UTC.

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.166% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/4da94744707b27a3ae1197bdd7127da4505dc5b1
https://git.kernel.org/stable/c/5884851a096d8afcdf91f0e542bac193035183a6
https://git.kernel.org/stable/c/c22a45817b9c92aa0391db60e2ed467c7e6027d7
https://lore.kernel.org/linux-cve-announce/2026082223-CVE-2026-74638-bed1@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74638
https://www.cve.org/CVERecord?id=CVE-2026-74638

History

Aug 24, 2026 2:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-362 CWE-854

Aug 24, 2026 12:15 PM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026082223-CVE-2026-74638-bed1@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74638 https://www.cve.org/CVERecord?id=CVE-2026-74638
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Aug 22, 2026 5:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-362 CWE-367 CWE-854

Aug 22, 2026 3:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Serialize the scheduler timeout handlers V3D exposes several independent hardware queues (BIN, RENDER, TFU and CSD) but has only a single, global reset. A timeout on any one queue therefore has to stop, reset and restart the schedulers of every other queue as well. That makes concurrent timeout handlers unsafe. `reset_lock` was never able to make them safe, as a driver-side lock can only cover the driver's &drm_sched_backend_ops.timedout_job callback. The scheduler handles the timed out job and its pending list around that callback, outside of the driver's control, so a global reset triggered by one queue can still interfere with another queue that is in the middle of handling a timeout of its own. Consequently, if a reset happens in the CSD queue while a CL-intensive application is running, the global reset stops and restarts the CL queue's scheduler while that queue is handling a timeout of its own. As drm_sched_stop() and drm_sched_start() subtract and add the credits of every job sitting on the pending list of the scheduler they are called on, and as the CL queue's handler concurrently takes its job off that same list and puts it back, the stop and the start no longer see the same set of jobs. The CL queue is left with more credits in flight than its limit: [ 327.302739] ------------[ cut here ]------------ [ 327.302744] WARNING: CPU: 2 PID: 43 at drivers/gpu/drm/scheduler/sched_main.c:102 drm_sched_run_job_work+0x238/0x4d0 [gpu_sched] [ 327.302884] CPU: 2 UID: 0 PID: 43 Comm: kworker/u16:1 Not tainted 6.18.39-v8-16k+ #3 PREEMPT [ 327.302889] Hardware name: Raspberry Pi 5 Model B Rev 1.0 (DT) [ 327.302893] Workqueue: v3d_bin drm_sched_run_job_work [gpu_sched] [ 327.302984] Call trace: [ 327.302987] drm_sched_run_job_work+0x238/0x4d0 [gpu_sched] (P) [ 327.302997] process_scheduled_works+0x180/0x3d0 [ 327.303010] worker_thread+0x268/0x3e8 [ 327.303016] kthread+0x140/0x250 [ 327.303022] ret_from_fork+0x10/0x20 [ 327.303031] ---[ end trace 0000000000000000 ]--- From that point on, the credit count of the CL queue is broken, causing a complete GPU hang and UI freeze. The DRM scheduler already provides a mechanism to serialize the timeout handlers of different schedulers: an ordered workqueue passed as drm_sched_init()'s @timeout_wq parameter. By default, each scheduler queues its timeout work on the system workqueue, which runs the handlers concurrently. Give all of the queues a shared ordered workqueue instead, as recommended by the DRM scheduler documentation for hardware that has distinct queues but resets globally.
Title		drm/v3d: Serialize the scheduler timeout handlers
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/4da94744707b27a3ae1197bdd7127da4505dc5b1 https://git.kernel.org/stable/c/5884851a096d8afcdf91f0e542bac193035183a6 https://git.kernel.org/stable/c/c22a45817b9c92aa0391db60e2ed467c7e6027d7