CVE-2026-68303: drm/vc4: hvs/v3d: Fix null dereference in unbind
In the Linux kernel, the following vulnerability has been resolved:
drm/vc4: hvs/v3d: Fix null dereference in unbind
The hvs and v3d drivers use devgetdrvdata(master) in their unbind functions. Since the vc4-drm gets removed before its dependent drivers (vc4hvs/vc4v3d) the vc4hvsunbind/vc4v3dunbind functions try to get drvdata of its master and fails with a null dereference error.
Use the data pointer passed to the unbind functions directly instead of devgetdrvdata(master). This avoids using potentially freed memory.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68303?
CVE-2026-68303 has a risk rating of 16, which indicates a significant vulnerability in the Linux kernel.
What is the cause of CVE-2026-68303?
CVE-2026-68303 is caused by a null dereference in the unbind functions of the hvs and v3d drivers in the Linux kernel.
How do I fix CVE-2026-68303?
To remediate CVE-2026-68303, ensure that you update your Linux kernel to the patched version released on August 10, 2026.
What components are affected by CVE-2026-68303?
CVE-2026-68303 affects the hvs and v3d drivers within the Linux kernel's DRM subsystem.
Is CVE-2026-68303 being actively exploited?
As of now, there are no publicly known exploits for CVE-2026-68303, but it is crucial to apply the patch to mitigate any potential risks.