Vulnerability-Lookup

GHSA-2JWW-55PG-7C53

Vulnerability from github – Published: 2026-10-23 15:31 – Updated: 2026-10-23 15:31

Details

In the Linux kernel, the following vulnerability has been resolved:

drm/vc4: Disable the V3D interrupt across runtime suspend

vc4_irq_disable() masks the V3D interrupt sources and then calls synchronize_irq() before the V3D is powered down. However, by itself, this is not enough to quiesce the interrupt handler.

synchronize_irq() waits for handlers that have already set IRQD_IRQ_INPROGRESS, and for irqchips reporting IRQCHIP_STATE_ACTIVE. A GIC interrupt chip is able to mark an interrupt active as soon as a CPU acknowledges it, so there these checks cover the whole dispatch path. On RPi 0-3, however, the interrupt controller is ARMCTRL, which has no active state. A CPU that has read the hwirq out of the pending register but has not yet reached handle_level_irq() stays invisible to synchronize_irq().

During a power transition, vc4_irq() may therefore run after the power domain is off, where every V3D register read will return 0xdeadbeef. 0xdeadbeef has FLDONE, FRDONE and OUTOMEM set. This problem doesn't trigger NULL pointer dereference issues only because the functions vc4_irq_finish_bin_job() and vc4_irq_finish_render_job() return early when there is no job pointer, but OUTOMEM is still able to schedule vc4_overflow_mem_work() after vc4_irq_disable() has already cancelled it.

Therefore, fix the spurious interrupts by disabling the interrupt line across the PM transition. To preserve the enable/disable balance, move vc4_irq_install() and request the IRQ line disabled before the first runtime resume.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-98946"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-23T13:17:15Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: Disable the V3D interrupt across runtime suspend\n\nvc4_irq_disable() masks the V3D interrupt sources and then calls\nsynchronize_irq() before the V3D is powered down. However, by itself,\nthis is not enough to quiesce the interrupt handler.\n\nsynchronize_irq() waits for handlers that have already set\nIRQD_IRQ_INPROGRESS, and for irqchips reporting IRQCHIP_STATE_ACTIVE.\nA GIC interrupt chip is able to mark an interrupt active as soon as a\nCPU acknowledges it, so there these checks cover the whole dispatch path.\nOn RPi 0-3, however, the interrupt controller is ARMCTRL, which has no\nactive state. A CPU that has read the hwirq out of the pending register\nbut has not yet reached handle_level_irq() stays invisible to\nsynchronize_irq().\n\nDuring a power transition, vc4_irq() may therefore run after the power\ndomain is off, where every V3D register read will return 0xdeadbeef.\n0xdeadbeef has FLDONE, FRDONE and OUTOMEM set. This problem doesn\u0027t\ntrigger NULL pointer dereference issues only because the functions\nvc4_irq_finish_bin_job() and vc4_irq_finish_render_job() return early\nwhen there is no job pointer, but OUTOMEM is still able to schedule\nvc4_overflow_mem_work() after vc4_irq_disable() has already cancelled it.\n\nTherefore, fix the spurious interrupts by disabling the interrupt line\nacross the PM transition. To preserve the enable/disable balance, move\nvc4_irq_install() and request the IRQ line disabled before the first\nruntime resume.",
  "id": "GHSA-2jww-55pg-7c53",
  "modified": "2026-10-23T15:31:32Z",
  "published": "2026-10-23T15:31:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98946"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6abc8e4dcfbc1d26a94c0ac037dfb3716f686b1f"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e81402c3d42041356cb7978510ebab997bc8d411"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

CVE-2026-98946 (GCVE-0-2026-98946)

Vulnerability from cvelistv5 – Published: 2026-10-23 12:19 – Updated: 2026-10-23 12:19

Title

drm/vc4: Disable the V3D interrupt across runtime suspend

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Disable the V3D interrupt across runtime suspend vc4_irq_disable() masks the V3D interrupt sources and then calls synchronize_irq() before the V3D is powered down. However, by itself, this is not enough to quiesce the interrupt handler. synchronize_irq() waits for handlers that have already set IRQD_IRQ_INPROGRESS, and for irqchips reporting IRQCHIP_STATE_ACTIVE. A GIC interrupt chip is able to mark an interrupt active as soon as a CPU acknowledges it, so there these checks cover the whole dispatch path. On RPi 0-3, however, the interrupt controller is ARMCTRL, which has no active state. A CPU that has read the hwirq out of the pending register but has not yet reached handle_level_irq() stays invisible to synchronize_irq(). During a power transition, vc4_irq() may therefore run after the power domain is off, where every V3D register read will return 0xdeadbeef. 0xdeadbeef has FLDONE, FRDONE and OUTOMEM set. This problem doesn't trigger NULL pointer dereference issues only because the functions vc4_irq_finish_bin_job() and vc4_irq_finish_render_job() return early when there is no job pointer, but OUTOMEM is still able to schedule vc4_overflow_mem_work() after vc4_irq_disable() has already cancelled it. Therefore, fix the spurious interrupts by disabling the interrupt line across the PM transition. To preserve the enable/disable balance, move vc4_irq_install() and request the IRQ line disabled before the first runtime resume.

Severity

No CVSS data available.

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 7067 records in the last 180 days details

References

2 references

URL	Tags
https://git.kernel.org/stable/c/e81402c3d42041356…
https://git.kernel.org/stable/c/6abc8e4dcfbc1d26a…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 9b6f461582e6b07e2ce93227a3e4661846e594ad , < e81402c3d42041356cb7978510ebab997bc8d411 (git) Affected: 9b6f461582e6b07e2ce93227a3e4661846e594ad , < 6abc8e4dcfbc1d26a94c0ac037dfb3716f686b1f (git)
Linux	Linux	Affected: 6.1 Unaffected: 0 , < 6.1 (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/vc4/vc4_irq.c",
            "drivers/gpu/drm/vc4/vc4_v3d.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e81402c3d42041356cb7978510ebab997bc8d411",
              "status": "affected",
              "version": "9b6f461582e6b07e2ce93227a3e4661846e594ad",
              "versionType": "git"
            },
            {
              "lessThan": "6abc8e4dcfbc1d26a94c0ac037dfb3716f686b1f",
              "status": "affected",
              "version": "9b6f461582e6b07e2ce93227a3e4661846e594ad",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/vc4/vc4_irq.c",
            "drivers/gpu/drm/vc4/vc4_v3d.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "lessThan": "6.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.11",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: Disable the V3D interrupt across runtime suspend\n\nvc4_irq_disable() masks the V3D interrupt sources and then calls\nsynchronize_irq() before the V3D is powered down. However, by itself,\nthis is not enough to quiesce the interrupt handler.\n\nsynchronize_irq() waits for handlers that have already set\nIRQD_IRQ_INPROGRESS, and for irqchips reporting IRQCHIP_STATE_ACTIVE.\nA GIC interrupt chip is able to mark an interrupt active as soon as a\nCPU acknowledges it, so there these checks cover the whole dispatch path.\nOn RPi 0-3, however, the interrupt controller is ARMCTRL, which has no\nactive state. A CPU that has read the hwirq out of the pending register\nbut has not yet reached handle_level_irq() stays invisible to\nsynchronize_irq().\n\nDuring a power transition, vc4_irq() may therefore run after the power\ndomain is off, where every V3D register read will return 0xdeadbeef.\n0xdeadbeef has FLDONE, FRDONE and OUTOMEM set. This problem doesn\u0027t\ntrigger NULL pointer dereference issues only because the functions\nvc4_irq_finish_bin_job() and vc4_irq_finish_render_job() return early\nwhen there is no job pointer, but OUTOMEM is still able to schedule\nvc4_overflow_mem_work() after vc4_irq_disable() has already cancelled it.\n\nTherefore, fix the spurious interrupts by disabling the interrupt line\nacross the PM transition. To preserve the enable/disable balance, move\nvc4_irq_install() and request the IRQ line disabled before the first\nruntime resume."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-23T12:19:05.190Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e81402c3d42041356cb7978510ebab997bc8d411"
        },
        {
          "url": "https://git.kernel.org/stable/c/6abc8e4dcfbc1d26a94c0ac037dfb3716f686b1f"
        }
      ],
      "title": "drm/vc4: Disable the V3D interrupt across runtime suspend",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98946",
    "datePublished": "2026-10-23T12:19:05.190Z",
    "dateReserved": "2026-09-25T10:25:14.381Z",
    "dateUpdated": "2026-10-23T12:19:05.190Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted