CVE-2026-99095
Received Received - Intake

Memory Leak in Linux Kernel V3D Driver

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: drain the hangcheck timer and works on V3D unbind Nothing stops the hangcheck timer that submitted jobs arm, or the job_done_work that the render-done interrupt queues, at teardown: vc4_irq_disable() cancels only overflow_mem_work, and vc4_gem_destroy() runs from the drm-managed release, after vc4_v3d_unbind() has already uninstalled the V3D interrupt and cleared vc4->v3d. A timer still armed by then reads V3D registers through the NULL vc4->v3d pointer, and the late callbacks run on the vc4_dev embedding them after it has been freed. Drain them in vc4_v3d_unbind(): shut the timer down and cancel reset_work before the interrupt is taken down, because its vc4_irq_reset() re-enables it, then flush job_done_work so that completions queued at teardown still release their jobs. This issue was found by an in-house static analysis tool.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-99095
EUVD
EUVD-2026-109901

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
Linux Linux d5b1a78a772f1e31a94f8babfa964152ec5e9aa5
Linux Linux d5b1a78a772f1e31a94f8babfa964152ec5e9aa5
Linux Linux d5b1a78a772f1e31a94f8babfa964152ec5e9aa5
Linux Linux d5b1a78a772f1e31a94f8babfa964152ec5e9aa5
Linux Linux d5b1a78a772f1e31a94f8babfa964152ec5e9aa5
Linux Linux 4.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper cleanup during V3D component unbind operations. The hangcheck timer and job completion work items are not properly stopped when the V3D device is unbound, leading to potential use-after-free scenarios where the timer tries to access freed memory through a NULL pointer.

Impact Analysis

This could cause system instability or crashes when unloading the V3D driver module. The NULL pointer dereference might trigger kernel panics or unexpected behavior in graphics operations.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the vulnerability in the drm/vc4 driver.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-99095. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart