PT-2026-61416 · Linux · Linux
CVE-2026-64099
·
Publicado
2026-07-19
·
Atualizado
2026-07-19
CVSS v3.1
7.8
Alta
| Vetor | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
In the Linux kernel, the following vulnerability has been resolved:
drm/v3d: Fix use-after-free of CPU job query arrays on error path
The CPU job ioctl's fail label calls kvfree() on cpu job's timestamp and
performance query arrays after v3d job cleanup(), which drops the job's
last reference and frees cpu job. Reading cpu job at that point is a
use-after-free. Also, on the early v3d job init() failure path, it is a
NULL dereference, since v3d job deallocate() zeroes the local pointer.
In the success path, the arrays are released from the scheduler's
.free job callback, but on the error path, they are freed manually, as
the job was never pushed to the scheduler. While the success path deals
with this correctly, the fail path doesn't.
On top of that, the manual kvfree() calls only free the array storage;
they don't drm syncobj put() the per-query syncobjs that
v3d timestamp query info free() and v3d performance query info free()
release on the success path. So the same fail path that triggers the
use-after-free also leaks one syncobj reference per query.
Unify the CPU job teardown into the CPU job's kref destructor, mirroring
v3d render job free(). The scheduler's .free job slot reverts to the
generic v3d sched job free() and the fail label drops the manual
kvfree() calls, leaving a single teardown path that is reached from both
the scheduler and the ioctl error path. That removes the use-after-free,
the NULL dereference, and the syncobj leak by construction.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux