UBUNTU-CVE-2026-99095: Medium severity ubuntu/linux-azure vulnerability
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: drain the hangcheck timer and works on V3D unbind Nothing stops the hangcheck timer that submitted jobs arm, or the jobdonework that the render-done interrupt queues, at teardown: vc4irqdisable() cancels only overflowmemwork, and vc4gemdestroy() runs from the drm-managed release, after vc4v3dunbind() has already uninstalled the V3D interrupt and cleared vc4->v3d. A timer still armed by then reads V3D registers through the NULL vc4->v3d pointer, and the late callbacks run on the vc4dev embedding them after it has been freed. Drain them in vc4v3dunbind(): shut the timer down and cancel resetwork before the interrupt is taken down, because its vc4irqreset() re-enables it, then flush jobdonework so that completions queued at teardown still release their jobs. This issue was found by an in-house static analysis tool.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Operational
In vc4_v3d_unbind(), shut down the hangcheck timer and cancel reset_work before disabling or uninstalling the V3D interrupt, because vc4_irq_reset() can re-enable the timer.
- Operational
In vc4_v3d_unbind(), flush job_done_work so completions queued during teardown release their jobs before the embedded vc4_dev is freed.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel VC4/V3D DRM driver are exposed when the V3D component is unbound while submitted GPU jobs have left the hangcheck timer armed or render-completion work queued.
What conditions are needed to trigger the vulnerability?
The issue requires teardown of the V3D driver component while asynchronous hangcheck, reset, or job-completion callbacks remain pending. A late timer callback can access V3D registers after the V3D pointer has been cleared, and late callbacks can run after the containing device has been freed.
What is the impact of a successful trigger?
The pending callbacks can dereference a NULL V3D pointer or execute against a freed VC4 device structure, causing invalid memory access during driver teardown.
What does the fix change?
The fix shuts down the hangcheck timer, cancels reset work before interrupt teardown, and flushes queued job-completion work during V3D unbind. This ensures queued completions release their jobs before teardown proceeds.