CVE-2026-93047: drm/v3d: Associate BOs with every job that accesses them
drm/v3d: Associate BOs with every job that accesses them
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Modify drm/v3d job submission so BOs are associated with every job that accesses them: add a per-job `has_implicit_dep` flag, attach BOs to the consuming RENDER or CSD job, and reference those BOs through `v3d_job_reference_bos()` so reservation locking acquires the correct implicit dependencies and mappings persist through submission completion. Exclude the global-flush CACHE_CLEAN job and the BIN job from consuming-job implicit synchronization.
Event History
Frequently Asked Questions
What condition is required for this issue to cause corruption?
A submission must expand into multiple jobs and include a trailing CACHE_CLEAN job, while a RENDER or CSD job in that chain consumes buffer objects. Another context must still be writing one of those buffer objects when the consuming job is dispatched without the missing implicit dependency.
What is the practical impact if the race occurs?
The hardware can read a buffer object while another context is writing it. This can result in data corruption.
How does the fix prevent the race?
The fix associates buffer objects with every job that consumes them, allowing reservation locking to acquire the required implicit dependencies. It also keeps those objects mapped through the end of the submission.