Look up another CVE · open CVE-2026-64099 in the interactive tracker
CVE-2026-64099
drm/v3d: Fix use-after-free of CPU job query arrays on error path
Published 2026-07-19 (3 months ago) by the Linux kernel CNA. Subsystem drivers/gpu. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-64099 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | fixed | 6.12.94-1 | Update the kernel and reboot. Fixed in 6.12.94-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.0.12-1 | Update the kernel and reboot. Fixed in 7.0.12-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.0.12-1 | Update the kernel and reboot. Fixed in 7.0.12-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
The CPU job ioctl's fail label calls kvfree() on cpu_job's timestamp and performance query arrays after v3d_job_cleanup(), which drops the job's last reference and frees cpu_job. Reading cpu_job at that point is a use-after-free. Also, on the early v3d_job_init() failure path, it is a NULL dereference, since v3d_job_deallocate() zeroes the local pointer. In the success path, the arrays are released from the scheduler's .free_job callback, but on the error path, they are freed manually, as the job was never pushed to the scheduler. While the success path deals with this correctly, the fail path doesn't. On top of that, the manual kvfree() calls only free the array storage; they don't drm_syncobj_put() the per-query syncobjs that v3d_timestamp_query_info_free() and v3d_performance_query_info_free() release on the success path. So the same fail path that triggers the use-after-free also leaks one syncobj reference per query. Unify the CPU job teardown into the CPU job's kref destructor, mirroring v3d_render_job_free(). The scheduler's .free_job slot reverts to the generic v3d_sched_job_free() and the fail label drops the manual kvfree() calls, leaving a single teardown path that is reached from both the scheduler and the ioctl error path. That removes the use-after-free, the NULL dereference, and the syncobj leak by construction.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/gpu/drm/v3d/v3d_sched.c
drivers/gpu/drm/v3d/v3d_submit.c
- What this is
- DRM DRIVERS FOR V3DMAINTAINERS section matched on drivers/gpu/drm/v3d/ · Supported
- Kernel module
- v3d
Check it on the machine
grep -w CONFIG_DRM_V3D /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w v3dPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.
- bookwormMnot built on amd64/amd64, amd64/cloud-amd64, amd64/rt/amd64, arm64/cloud-arm64, armhf/armmp, armhf/armmp-lpae, armhf/rt/armmp, i386/686, i386/686-pae, i386/rt/686-pae, ppc64el/powerpc64le
- trixieMnot built on amd64/amd64, amd64/cloud-amd64, amd64/rt/amd64, arm64/cloud-arm64, armel/rpi, armhf/armmp, armhf/armmp-lpae, armhf/rt/armmp, ppc64el/powerpc64le, ppc64el/powerpc64le-64k, riscv64/riscv64, s390x/s390x
- forky, sidMnot built on amd64/amd64, amd64/cloud-amd64, amd64/rt-amd64, arm64/cloud-arm64, armhf/armmp, armhf/armmp-lpae, loong64/loong64, ppc64el/powerpc64le, ppc64el/powerpc64le-64k, riscv64/riscv64, s390x/s390x
- M
- a module where it is built at all; some flavours do not build it
- Build switch
- CONFIG_DRM_V3D
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-07-19 (3 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.13%, higher than 2.6% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- drivers/gpu
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.8 | 6.12.93 | acd55ea40d03 |
| 6.8 | 6.18.34 | 0f8efc45740b |
| 6.8 | 7.0.11 | 69c2a1fec2e7 |
| 6.8 | 7.1 | b0fe80c0b925 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The bug is reachable only through the DRM_IOCTL_V3D_SUBMIT_CPU ioctl on /dev/dri/renderD*, requiring local access to the GPU render node; there is no network, adjacent-radio, or physical-device attack path to this code.
- AC:LAttack complexity, low
- An attacker can deterministically trigger the vulnerable error path by submitting a crafted CPU job with timestamp/performance-query extensions and then forcing a controlled failure (e.g., invalid BO handle after v3d_job_init(), or a multisync init failure), without depending on races or external timing.
- PR:LPrivileges required, low
- The ioctl is permitted on render nodes (DRM_RENDER_ALLOW | DRM_AUTH), which unprivileged local users on affected Broadcom V3D systems (e.g., Raspberry Pi users in the render/video group, GPU containers with /dev/dri passthrough) can open without real root in the init namespace.
- UI:NUser interaction, none
- Exploitation requires only the attacker's own ioctl submissions to the render node; no separate victim user action (opening files, mounting filesystems, clicking links) is needed beyond the attacker already having local GPU client access.
- S:UScope, unchanged
- Successful exploitation yields standard host-kernel memory corruption and privilege escalation within the same kernel security authority; it does not inherently cross a hypervisor/IOMMU boundary or constitute a VM escape on its own.
- C:HConfidentiality impact, high
- The fail path performs a use-after-free read of freed cpu_job metadata to reach timestamp/performance query arrays, which per kernel UAF guidance enables arbitrary kernel memory disclosure via heap grooming and corrupted object interpretation.
- I:HIntegrity impact, high
- The same use-after-free on kernel heap objects can be leveraged for arbitrary kernel writes and control-flow hijacking through heap spraying and reuse of the freed cpu_job/query structures, not merely a bounded or cosmetic corruption.
- A:HAvailability impact, high
- The vulnerable error path also NULL-dereferences cpu_job when v3d_job_init() fails after v3d_job_deallocate(), and the use-after-free itself can provoke kernel oops/panic, giving reliable high availability impact.