CVE-2026-98309: drm/vc4: Use managed KMS polling to fix UAF on unbind
drm/vc4: Use managed KMS polling to fix UAF on unbind
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.158.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.158 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.112 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.54 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.8 - Configuration
Replace drm_kms_helper_poll_init() with drmm_kms_helper_poll_init() so polling is finalized with the device during unbind.
Linux kernel drm/vc4 KMS polling initialization in vc4_kms_load() = drmm_kms_helper_poll_init()
Event History
Frequently Asked Questions
What conditions trigger the use-after-free?
The issue is triggered when the vc4 kernel module is unloaded after it has initialized KMS polling. The documented reproduction is loading vc4, removing it with rmmod vc4, and then waiting for the still-scheduled output polling work to run.
Is this remotely exploitable based on the available information?
The available information describes a local kernel-module unload scenario and does not identify any remote attack vector. Exploitation requires the vc4 driver to be loaded and then unbound or removed while its polling work remains scheduled.
How can I identify whether the issue has occurred?
Systems may report KASAN slab-use-after-free errors after vc4 is removed, including reports involving delayed_work_timer_fn or drm_client_dev_hotplug. The affected work may appear on the events workqueue as output_poll_execute from drm_kms_helper.
What mitigation is indicated if an update cannot be applied immediately?
Avoid unloading or unbinding the vc4 driver after it has been loaded. The defect occurs because output polling remains scheduled after device teardown.