CVE-2026-46314: drm/v3d: Reject empty multisync extension to prevent infinite loop
drm/v3d: Reject empty multisync extension to prevent infinite loop
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In v3d_get_extensions()/multisync extension processing, reject a multisync extension where se->in_sync_count == 0 and se->out_sync_count == 0 by returning -EINVAL (the guard should fail when count is zero to prevent the infinite loop).
Linux kernel DRM/v3d multisync extension handling reject empty multisync extension when both in_sync_count and out_sync_count are zero = return -EINVAL
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46314?
CVE-2026-46314 has a risk score of 18, indicating it poses a significant security threat.
How do I fix CVE-2026-46314?
To address CVE-2026-46314, update to the latest version of the Linux kernel that includes the patch for this vulnerability.
Who is affected by CVE-2026-46314?
CVE-2026-46314 affects users of the Linux kernel utilizing the drm/v3d driver.
What causes the vulnerability in CVE-2026-46314?
CVE-2026-46314 is caused by the drm/v3d driver processing an unbounded, userspace-supplied list of ioctl extensions.
Is CVE-2026-46314 exploitable remotely?
CVE-2026-46314 is not remotely exploitable; it requires local user access to exploit the vulnerability.