CVE-2026-68233: drm/vc4: Shut down BO cache timer before teardown
In the Linux kernel, the following vulnerability has been resolved:
drm/vc4: Shut down BO cache timer before teardown
The BO cache timer callback schedules timework, and timework can rearm the timer through vc4bocachefreeold().
vc4bocachedestroy() deletes the timer and then cancels the work, which does not break that cycle: the work being cancelled can rearm the timer, and the timer then queues work again after teardown.
Use timershutdownsync() instead, so the timer cannot be rearmed and the cycle ends with cancelworksync().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In vc4 BO cache teardown (e.g., vc4_bo_cache_destroy() / vc4_bo_cache_free_old()), use timer_shutdown_sync() so the BO cache timer cannot be rearmed during teardown; ensure the cycle ends with cancel_work_sync() as described.
drm/vc4 (BO cache timer teardown) timer_shutdown_sync() usage for BO cache timer callback cycle = Use timer_shutdown_sync() instead of cancel_work_sync() to prevent timer rearming
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68233?
CVE-2026-68233 has a risk rating of 24.
How do I fix CVE-2026-68233?
To fix CVE-2026-68233, update the Linux kernel to the patched version that addresses this vulnerability.
What systems are affected by CVE-2026-68233?
CVE-2026-68233 affects systems running the affected versions of the Linux kernel with the drm/vc4 module.
What does CVE-2026-68233 involve?
CVE-2026-68233 involves an issue where the BO cache timer is not properly shut down before the teardown in the Linux kernel.
Is CVE-2026-68233 exploitable?
The exploitability of CVE-2026-68233 depends on the specific configuration and usage of the affected Linux kernel.