CVE-2026-93192: drm/v3d: Clear queue->active_job when v3d_fence_create() fails

Published Sep 17, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

drm/v3d: Clear queue->activejob when v3dfencecreate() fails

The runjob() callbacks for BIN, RENDER, TFU and CSD assign the incoming job to queue->activejob before calling v3dfencecreate(). If v3dfencecreate() fails, the callback returns NULL without clearing activejob, leaving a dangling pointer.

Create a failure path in all runjob() callbacks that clears the active job before returning NULL. The BIN path takes queue->queuelock around the clear as it races against v3doverflowmemwork(); RENDER, TFU and CSD paths have no concurrent reader, so the clear is lock-free.

Affected Software

1 affected component
Linux Linux kernel

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Configuration

    In all run_job() callbacks for BIN, RENDER, TFU, and CSD, add a failure path that clears queue->active_job before returning NULL when v3d_fence_create() fails (the issue is that these callbacks currently assign the incoming active_job and may return NULL without clearing it).

    Linux kernel drm/v3d queue->active_job handling in run_job() callbacks (BIN, RENDER, TFU, CSD) = Ensure queue->active_job is cleared on failure before returning NULL when v3d_fence_create() fails

Event History

Sep 17, 2026
CVE Published
via MITRE·04:12 PM
Data Sourced
via MITRE·04:12 PM
Description

Frequently Asked Questions

1

Which V3D job queues are affected by this failure handling issue?

The issue involves the BIN, RENDER, TFU, and CSD run_job() callback paths. Each can leave queue->active_job pointing at a job after v3d_fence_create() fails.

2

What must occur for the dangling pointer to be left behind?

v3d_fence_create() must fail after the incoming job has been assigned to queue->active_job. The affected callback then returns NULL without clearing that pointer.

3

Is there any concurrency-specific behavior in the affected paths?

The BIN cleanup path must clear active_job while holding queue->queue_lock because it can race with v3d_overflow_mem_work(). The RENDER, TFU, and CSD paths have no concurrent reader and clear the pointer without a lock.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203