CVE-2026-93192: drm/v3d: Clear queue->active_job when v3d_fence_create() fails
In the Linux kernel, the following vulnerability has been resolved:
drm/v3d: Clear queue->activejob when v3dfencecreate() fails
The runjob() callbacks for BIN, RENDER, TFU and CSD assign the incoming job to queue->activejob before calling v3dfencecreate(). If v3dfencecreate() fails, the callback returns NULL without clearing activejob, leaving a dangling pointer.
Create a failure path in all runjob() callbacks that clears the active job before returning NULL. The BIN path takes queue->queuelock around the clear as it races against v3doverflowmemwork(); RENDER, TFU and CSD paths have no concurrent reader, so the clear is lock-free.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In all run_job() callbacks for BIN, RENDER, TFU, and CSD, add a failure path that clears queue->active_job before returning NULL when v3d_fence_create() fails (the issue is that these callbacks currently assign the incoming active_job and may return NULL without clearing it).
Linux kernel drm/v3d queue->active_job handling in run_job() callbacks (BIN, RENDER, TFU, CSD) = Ensure queue->active_job is cleared on failure before returning NULL when v3d_fence_create() fails
Event History
Frequently Asked Questions
Which V3D job queues are affected by this failure handling issue?
The issue involves the BIN, RENDER, TFU, and CSD run_job() callback paths. Each can leave queue->active_job pointing at a job after v3d_fence_create() fails.
What must occur for the dangling pointer to be left behind?
v3d_fence_create() must fail after the incoming job has been assigned to queue->active_job. The affected callback then returns NULL without clearing that pointer.
Is there any concurrency-specific behavior in the affected paths?
The BIN cleanup path must clear active_job while holding queue->queue_lock because it can race with v3d_overflow_mem_work(). The RENDER, TFU, and CSD paths have no concurrent reader and clear the pointer without a lock.