CVE-2026-64099
Received Received - Intake

Use-After-Free in Linux Kernel DRM V3D Driver

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Fix use-after-free of CPU job query arrays on error path The CPU job ioctl's fail label calls kvfree() on cpu_job's timestamp and performance query arrays after v3d_job_cleanup(), which drops the job's last reference and frees cpu_job. Reading cpu_job at that point is a use-after-free. Also, on the early v3d_job_init() failure path, it is a NULL dereference, since v3d_job_deallocate() zeroes the local pointer. In the success path, the arrays are released from the scheduler's .free_job callback, but on the error path, they are freed manually, as the job was never pushed to the scheduler. While the success path deals with this correctly, the fail path doesn't. On top of that, the manual kvfree() calls only free the array storage; they don't drm_syncobj_put() the per-query syncobjs that v3d_timestamp_query_info_free() and v3d_performance_query_info_free() release on the success path. So the same fail path that triggers the use-after-free also leaks one syncobj reference per query. Unify the CPU job teardown into the CPU job's kref destructor, mirroring v3d_render_job_free(). The scheduler's .free_job slot reverts to the generic v3d_sched_job_free() and the fail label drops the manual kvfree() calls, leaving a single teardown path that is reached from both the scheduler and the ioctl error path. That removes the use-after-free, the NULL dereference, and the syncobj leak by construction.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64099
EUVD
EUVD-2026-45784

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's drm/v3d driver. It occurs when the CPU job ioctl's error handling frees memory after it has already been freed by another function, leading to potential memory corruption or crashes. The issue stems from inconsistent cleanup paths between success and error scenarios in the v3d driver's job handling code.

Detection Guidance

This vulnerability is specific to the Linux kernel's drm/v3d driver and requires kernel-level inspection. Detection involves checking kernel logs for GPU-related errors or crashes, particularly during ioctl operations. Commands like dmesg | grep -i v3d or journalctl -k | grep -i v3d may help identify issues. No network-specific detection commands are applicable.

Impact Analysis

This vulnerability could cause system instability, crashes, or unexpected behavior in applications using the Linux kernel's graphics drivers. It may lead to data corruption or privilege escalation if exploited maliciously. Systems running affected kernel versions could experience sudden failures during graphics operations.

Compliance Impact

This vulnerability is a use-after-free and NULL dereference issue in the Linux kernel's drm/v3d driver, which does not directly relate to data privacy or security controls required by GDPR or HIPAA. It primarily affects system stability and memory management rather than compliance with these regulations.

Mitigation Strategies

Update your Linux kernel to the latest stable version where this vulnerability is patched. If using a distribution kernel, apply vendor-provided updates immediately. Avoid using affected GPU ioctl operations until patched. Monitor kernel security advisories for further updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64099. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart