CVE-2026-99095 - Vulnerability Details

- drm/vc4: drain the hangcheck timer and works on V3D unbind

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/vc4: drain the hangcheck timer and works on V3D unbind

Nothing stops the hangcheck timer that submitted jobs arm, or the
job_done_work that the render-done interrupt queues, at teardown:
vc4_irq_disable() cancels only overflow_mem_work, and vc4_gem_destroy()
runs from the drm-managed release, after vc4_v3d_unbind() has already
uninstalled the V3D interrupt and cleared vc4->v3d. A timer still armed
by then reads V3D registers through the NULL vc4->v3d pointer, and the
late callbacks run on the vc4_dev embedding them after it has been
freed.

Drain them in vc4_v3d_unbind(): shut the timer down and cancel
reset_work before the interrupt is taken down, because its
vc4_irq_reset() re-enables it, then flush job_done_work so that
completions queued at teardown still release their jobs.

This issue was found by an in-house static analysis tool.

Published: 2026-10-26

Score: n/a

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel VC4 DRM driver fails to correctly drain the hangcheck timer when the V3D device is unbound. Because the timer remains armed and calls back through a NULL vc4->v3d pointer after the driver has been freed, a null pointer dereference can occur, potentially causing a kernel panic. This flaw can be exploited to bring the system down, leading to a denial‑of‑service condition.

Affected Systems

All Linux kernels that contain the VC4 DRM driver are affected. The risk applies regardless of the precise release, as the patch addresses a core driver routine. No specific version numbers are listed, so any kernel prior to the applied fix should be considered vulnerable.

Risk and Exploitability

No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, indicating that public exploitation data are lacking. The flaw requires local access to the affected DRM device, suggesting that an attacker must either be a privileged user or have the ability to unload the driver. Without a public exploit, the probability of exploitation is unknown, but the potential impact is high due to the possibility of a kernel crash.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`d5b1a78a772f1e31a94f8babfa964152ec5e9aa5`	affected	< 17c5fa371de2d5508755cd4cd227cc8e2bb99240
`d5b1a78a772f1e31a94f8babfa964152ec5e9aa5`	affected	< a046cd60ff3f4a8c8e672b3b18902682c1f91731
`d5b1a78a772f1e31a94f8babfa964152ec5e9aa5`	affected	< e61465d3e0292daebf4dbb34e0add635e2439569
`d5b1a78a772f1e31a94f8babfa964152ec5e9aa5`	affected	< ade226dfd28cf2fd1dce143c556d1ee77d953696
`d5b1a78a772f1e31a94f8babfa964152ec5e9aa5`	affected	< 94cf5971b1d04c6382437387c4dc3836cc7a1437

Linux

affected

Version	Status	Constraints
`4.5`	affected	—
`0`	unaffected	< 4.5
`6.6.160`	unaffected	≤ 6.6.*
`6.12.113`	unaffected	≤ 6.12.*
`6.18.57`	unaffected	≤ 6.18.*
`7.2.11`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

100%

Version	Status	Scheme	Platform
`[d5b1a78a772f1e31a94f8babfa964152ec5e9aa5,17c5fa371de2d5508755cd4cd227cc8e2bb99240)`	affected	code_commit	—
`[d5b1a78a772f1e31a94f8babfa964152ec5e9aa5,a046cd60ff3f4a8c8e672b3b18902682c1f91731)`	affected	code_commit	—
`[d5b1a78a772f1e31a94f8babfa964152ec5e9aa5,e61465d3e0292daebf4dbb34e0add635e2439569)`	affected	code_commit	—
`[d5b1a78a772f1e31a94f8babfa964152ec5e9aa5,ade226dfd28cf2fd1dce143c556d1ee77d953696)`	affected	code_commit	—
`[d5b1a78a772f1e31a94f8babfa964152ec5e9aa5,94cf5971b1d04c6382437387c4dc3836cc7a1437)`	affected	code_commit	—

Linux

100%

Version	Status	Scheme	Platform
`4.5`	affected	generic	—
`[0,4.5)`	unaffected	generic	—
`[6.6.160,6.7.0)`	unaffected	semver	—
`[6.12.113,6.13.0)`	unaffected	semver	—
`[6.18.57,6.19.0)`	unaffected	semver	—
`[7.2.11,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[d5b1a78a772f1e31a94f8babfa964152ec5e9aa5,17c5fa371de2d5508755cd4cd227cc8e2bb99240)`	affected	code_commit	—
`[d5b1a78a772f1e31a94f8babfa964152ec5e9aa5,a046cd60ff3f4a8c8e672b3b18902682c1f91731)`	affected	code_commit	—
`[d5b1a78a772f1e31a94f8babfa964152ec5e9aa5,e61465d3e0292daebf4dbb34e0add635e2439569)`	affected	code_commit	—
`[d5b1a78a772f1e31a94f8babfa964152ec5e9aa5,ade226dfd28cf2fd1dce143c556d1ee77d953696)`	affected	code_commit	—
`[d5b1a78a772f1e31a94f8babfa964152ec5e9aa5,94cf5971b1d04c6382437387c4dc3836cc7a1437)`	affected	code_commit	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`4.5`	affected	generic	—
`[0,4.5)`	unaffected	generic	—
`[6.6.160,6.7.0)`	unaffected	semver	—
`[6.12.113,6.13.0)`	unaffected	semver	—
`[6.18.57,6.19.0)`	unaffected	semver	—
`[7.2.11,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the VC4 driver fix or apply the specific patch that drains the hangcheck timer before unbind.
If a kernel update cannot be applied immediately, avoid unloading the VC4 DRM driver during critical operations or disable V3D support to mitigate the timer issue.
Set up kernel crash monitoring and automated system recovery so that any accidental panic can be detected and the system restored quickly.

Generated by OpenCVE AI on October 26, 2026 at 16:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/17c5fa371de2d5508755cd4cd227cc8e2bb99240
https://git.kernel.org/stable/c/94cf5971b1d04c6382437387c4dc3836cc7a1437
https://git.kernel.org/stable/c/a046cd60ff3f4a8c8e672b3b18902682c1f91731
https://git.kernel.org/stable/c/ade226dfd28cf2fd1dce143c556d1ee77d953696
https://git.kernel.org/stable/c/e61465d3e0292daebf4dbb34e0add635e2439569

History

Mon, 26 Oct 2026 18:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux linux
Vendors & Products		Linux linux

Mon, 26 Oct 2026 17:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416 CWE-476

Mon, 26 Oct 2026 15:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: drm/vc4: drain the hangcheck timer and works on V3D unbind Nothing stops the hangcheck timer that submitted jobs arm, or the job_done_work that the render-done interrupt queues, at teardown: vc4_irq_disable() cancels only overflow_mem_work, and vc4_gem_destroy() runs from the drm-managed release, after vc4_v3d_unbind() has already uninstalled the V3D interrupt and cleared vc4->v3d. A timer still armed by then reads V3D registers through the NULL vc4->v3d pointer, and the late callbacks run on the vc4_dev embedding them after it has been freed. Drain them in vc4_v3d_unbind(): shut the timer down and cancel reset_work before the interrupt is taken down, because its vc4_irq_reset() re-enables it, then flush job_done_work so that completions queued at teardown still release their jobs. This issue was found by an in-house static analysis tool.
Title		drm/vc4: drain the hangcheck timer and works on V3D unbind
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/17c5fa371de2d5508755cd4cd227cc8e2bb99240 https://git.kernel.org/stable/c/94cf5971b1d04c6382437387c4dc3836cc7a1437 https://git.kernel.org/stable/c/a046cd60ff3f4a8c8e672b3b18902682c1f91731 https://git.kernel.org/stable/c/ade226dfd28cf2fd1dce143c556d1ee77d953696 https://git.kernel.org/stable/c/e61465d3e0292daebf4dbb34e0add635e2439569

Subscriptions

Linux Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-26T14:52:02.647Z

Updated: 2026-10-26T14:52:02.647Z

Reserved: 2026-09-25T10:25:14.390Z

Link: CVE-2026-99095

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-26T15:16:48.500

Modified: 2026-10-26T15:16:48.500

Link: CVE-2026-99095

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-10-26T18:00:08Z

Weaknesses

CWE-416
Use After Free
CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object