CVE-2026-64099 (GCVE-0-2026-64099)

Vulnerability from cvelistv5 – Published: 2026-07-19 15:40 – Updated: 2026-07-20 13:43
VLAI
Title
drm/v3d: Fix use-after-free of CPU job query arrays on error path
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Fix use-after-free of CPU job query arrays on error path The CPU job ioctl's fail label calls kvfree() on cpu_job's timestamp and performance query arrays after v3d_job_cleanup(), which drops the job's last reference and frees cpu_job. Reading cpu_job at that point is a use-after-free. Also, on the early v3d_job_init() failure path, it is a NULL dereference, since v3d_job_deallocate() zeroes the local pointer. In the success path, the arrays are released from the scheduler's .free_job callback, but on the error path, they are freed manually, as the job was never pushed to the scheduler. While the success path deals with this correctly, the fail path doesn't. On top of that, the manual kvfree() calls only free the array storage; they don't drm_syncobj_put() the per-query syncobjs that v3d_timestamp_query_info_free() and v3d_performance_query_info_free() release on the success path. So the same fail path that triggers the use-after-free also leaks one syncobj reference per query. Unify the CPU job teardown into the CPU job's kref destructor, mirroring v3d_render_job_free(). The scheduler's .free_job slot reverts to the generic v3d_sched_job_free() and the fail label drops the manual kvfree() calls, leaving a single teardown path that is reached from both the scheduler and the ioctl error path. That removes the use-after-free, the NULL dereference, and the syncobj leak by construction.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 9ba0ff3e083f6a4a0b6698f06bfff74805fefa5f , < acd55ea40d03e06f20a9986363019e0e5173990e (git)
Affected: 9ba0ff3e083f6a4a0b6698f06bfff74805fefa5f , < 0f8efc45740b0628a787d1b0be8a0ddabd700625 (git)
Affected: 9ba0ff3e083f6a4a0b6698f06bfff74805fefa5f , < 69c2a1fec2e7ca25598180816f3bc56e1842eb41 (git)
Affected: 9ba0ff3e083f6a4a0b6698f06bfff74805fefa5f , < b0fe80c0b9250b35e2211bf3117e7aca814a21b0 (git)
Create a notification for this product.
Linux Linux Affected: 6.8
Unaffected: 0 , < 6.8 (semver)
Unaffected: 6.12.93 , ≤ 6.12.* (semver)
Unaffected: 6.18.34 , ≤ 6.18.* (semver)
Unaffected: 7.0.11 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/v3d/v3d_sched.c",
            "drivers/gpu/drm/v3d/v3d_submit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "acd55ea40d03e06f20a9986363019e0e5173990e",
              "status": "affected",
              "version": "9ba0ff3e083f6a4a0b6698f06bfff74805fefa5f",
              "versionType": "git"
            },
            {
              "lessThan": "0f8efc45740b0628a787d1b0be8a0ddabd700625",
              "status": "affected",
              "version": "9ba0ff3e083f6a4a0b6698f06bfff74805fefa5f",
              "versionType": "git"
            },
            {
              "lessThan": "69c2a1fec2e7ca25598180816f3bc56e1842eb41",
              "status": "affected",
              "version": "9ba0ff3e083f6a4a0b6698f06bfff74805fefa5f",
              "versionType": "git"
            },
            {
              "lessThan": "b0fe80c0b9250b35e2211bf3117e7aca814a21b0",
              "status": "affected",
              "version": "9ba0ff3e083f6a4a0b6698f06bfff74805fefa5f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/v3d/v3d_sched.c",
            "drivers/gpu/drm/v3d/v3d_submit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Fix use-after-free of CPU job query arrays on error path\n\nThe CPU job ioctl\u0027s fail label calls kvfree() on cpu_job\u0027s timestamp and\nperformance query arrays after v3d_job_cleanup(), which drops the job\u0027s\nlast reference and frees cpu_job. Reading cpu_job at that point is a\nuse-after-free. Also, on the early v3d_job_init() failure path, it is a\nNULL dereference, since v3d_job_deallocate() zeroes the local pointer.\n\nIn the success path, the arrays are released from the scheduler\u0027s\n.free_job callback, but on the error path, they are freed manually, as\nthe job was never pushed to the scheduler. While the success path deals\nwith this correctly, the fail path doesn\u0027t.\n\nOn top of that, the manual kvfree() calls only free the array storage;\nthey don\u0027t drm_syncobj_put() the per-query syncobjs that\nv3d_timestamp_query_info_free() and v3d_performance_query_info_free()\nrelease on the success path. So the same fail path that triggers the\nuse-after-free also leaks one syncobj reference per query.\n\nUnify the CPU job teardown into the CPU job\u0027s kref destructor, mirroring\nv3d_render_job_free(). The scheduler\u0027s .free_job slot reverts to the\ngeneric v3d_sched_job_free() and the fail label drops the manual\nkvfree() calls, leaving a single teardown path that is reached from both\nthe scheduler and the ioctl error path. That removes the use-after-free,\nthe NULL dereference, and the syncobj leak by construction."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-20T13:43:19.332Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/acd55ea40d03e06f20a9986363019e0e5173990e"
        },
        {
          "url": "https://git.kernel.org/stable/c/0f8efc45740b0628a787d1b0be8a0ddabd700625"
        },
        {
          "url": "https://git.kernel.org/stable/c/69c2a1fec2e7ca25598180816f3bc56e1842eb41"
        },
        {
          "url": "https://git.kernel.org/stable/c/b0fe80c0b9250b35e2211bf3117e7aca814a21b0"
        }
      ],
      "title": "drm/v3d: Fix use-after-free of CPU job query arrays on error path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64099",
    "datePublished": "2026-07-19T15:40:04.925Z",
    "dateReserved": "2026-07-19T07:54:57.033Z",
    "dateUpdated": "2026-07-20T13:43:19.332Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64099",
      "date": "2026-07-21",
      "epss": "0.00134",
      "percentile": "0.03306"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-64099\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-19T16:17:50.983\",\"lastModified\":\"2026-07-20T15:17:09.060\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/v3d: Fix use-after-free of CPU job query arrays on error path\\n\\nThe CPU job ioctl\u0027s fail label calls kvfree() on cpu_job\u0027s timestamp and\\nperformance query arrays after v3d_job_cleanup(), which drops the job\u0027s\\nlast reference and frees cpu_job. Reading cpu_job at that point is a\\nuse-after-free. Also, on the early v3d_job_init() failure path, it is a\\nNULL dereference, since v3d_job_deallocate() zeroes the local pointer.\\n\\nIn the success path, the arrays are released from the scheduler\u0027s\\n.free_job callback, but on the error path, they are freed manually, as\\nthe job was never pushed to the scheduler. While the success path deals\\nwith this correctly, the fail path doesn\u0027t.\\n\\nOn top of that, the manual kvfree() calls only free the array storage;\\nthey don\u0027t drm_syncobj_put() the per-query syncobjs that\\nv3d_timestamp_query_info_free() and v3d_performance_query_info_free()\\nrelease on the success path. So the same fail path that triggers the\\nuse-after-free also leaks one syncobj reference per query.\\n\\nUnify the CPU job teardown into the CPU job\u0027s kref destructor, mirroring\\nv3d_render_job_free(). The scheduler\u0027s .free_job slot reverts to the\\ngeneric v3d_sched_job_free() and the fail label drops the manual\\nkvfree() calls, leaving a single teardown path that is reached from both\\nthe scheduler and the ioctl error path. That removes the use-after-free,\\nthe NULL dereference, and the syncobj leak by construction.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/v3d/v3d_sched.c\",\"drivers/gpu/drm/v3d/v3d_submit.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"9ba0ff3e083f6a4a0b6698f06bfff74805fefa5f\",\"lessThan\":\"acd55ea40d03e06f20a9986363019e0e5173990e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9ba0ff3e083f6a4a0b6698f06bfff74805fefa5f\",\"lessThan\":\"0f8efc45740b0628a787d1b0be8a0ddabd700625\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9ba0ff3e083f6a4a0b6698f06bfff74805fefa5f\",\"lessThan\":\"69c2a1fec2e7ca25598180816f3bc56e1842eb41\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9ba0ff3e083f6a4a0b6698f06bfff74805fefa5f\",\"lessThan\":\"b0fe80c0b9250b35e2211bf3117e7aca814a21b0\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/v3d/v3d_sched.c\",\"drivers/gpu/drm/v3d/v3d_submit.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.93\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.34\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.11\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0f8efc45740b0628a787d1b0be8a0ddabd700625\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/69c2a1fec2e7ca25598180816f3bc56e1842eb41\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/acd55ea40d03e06f20a9986363019e0e5173990e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b0fe80c0b9250b35e2211bf3117e7aca814a21b0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-07-20T17:11:56+00:00",
      "cve": "CVE-2026-64099",
      "id": "CVE-2026-64099",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_not_affected": "275",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/v3d: Fix use-after-free of CPU job query arrays on error path",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64099.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.