CVE-2026-72327

Received Received - Intake

NULL Pointer Dereference in Linux Kernel DRM V3D Driver

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Reject invalid indirect BO handle in indirect CSD setup v3d_get_cpu_indirect_csd_params() looks up the indirect buffer object from a userspace-supplied handle but never checks the result. A bogus or stale handle makes drm_gem_object_lookup() return NULL, which is then stored in info->indirect and only dereferenced later when the indirect CSD job runs, turning a userspace mistake into a NULL pointer dereference in the kernel. Bail out with -ENOENT as soon as the lookup fails, so the bad handle is rejected at submission time.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72327

EUVD

EUVD-2026-59226

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's drm/v3d driver. It involves a failure to validate a userspace-supplied buffer handle in indirect command submission. When an invalid handle is provided, the kernel stores a NULL pointer which later causes a NULL pointer dereference when the job runs, leading to a kernel crash.

Detection Guidance

This vulnerability is specific to the Linux kernel's DRM/V3D driver and requires kernel-level detection. There are no standard network or system commands to detect it directly. Monitoring kernel logs for NULL pointer dereference errors related to the V3D driver may indicate exploitation or crashes. Check kernel logs using 'dmesg | grep -i v3d' or 'journalctl -k | grep -i v3d'.

Impact Analysis

This vulnerability could allow a local attacker to crash the system by submitting a malicious indirect buffer handle. This results in a kernel panic, causing denial of service and potential data loss or system instability.

Compliance Impact

This vulnerability is a NULL pointer dereference in the Linux kernel's DRM driver, which could lead to kernel crashes or potential privilege escalation. It does not directly affect compliance with GDPR or HIPAA, as those standards focus on data protection and privacy rather than kernel-level vulnerabilities.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for CVE-2026-72327. If your distribution has not yet released a patched kernel, consider applying the upstream patch manually or contact your vendor for an update. Avoid using untrusted userspace applications that interact with the V3D driver until patched.

Hi! I’m here to help you understand CVE-2026-72327. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70