CVE-2026-93192
HIGH
MEDIUM
Priority: 0.01
BB Relevance:
41/100
Published: 2026-09-17
Modified: 2026-10-30
First seen: 2026-10-30
Status: active
Attack Surface
Low Complexity
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Local
AC:
Low
PR:
Low
UI:
None
S:
Unchanged
C:
High
I:
High
A:
High
Description
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Clear queue->active_job when v3d_fence_create() fails The run_job() callbacks for BIN, RENDER, TFU and CSD assign the incoming job to queue->active_job before calling v3d_fence_create(). If v3d_fence_create() fails, the callback returns NULL without clearing active_job, leaving a dangling pointer. Create a failure path in all run_job() callbacks that clears the active job before returning NULL. The BIN path takes queue->queue_lock around the clear as it races against v3d_overflow_mem_work(); RENDER, TFU and CSD paths have no concurrent reader, so the clear is lock-free.
Affected Software (7)
| Vendor | Product | Version |
|---|---|---|
| Linux | Linux | a783a09ee76d6259296dc6aeea2b6884fa526980 < dc0fba19ef518920073d1d639317b2dd8266fe5e |
| Linux | Linux | a783a09ee76d6259296dc6aeea2b6884fa526980 < 1f661f42beb558b2d21882f0cd527ed6c8e7e749 |
| Linux | Linux | a783a09ee76d6259296dc6aeea2b6884fa526980 < bdeb73d7312100e00c3e643ff233f09b6ec114aa |
| Linux | Linux | a783a09ee76d6259296dc6aeea2b6884fa526980 < 3a8aa74859dd73eaa76c55eb74da708e56ef51c5 |
| Linux | Linux | a783a09ee76d6259296dc6aeea2b6884fa526980 < 0b9878aba5cf93bc2b55ba9eb807757ce3239bec |
| Linux | Linux | a783a09ee76d6259296dc6aeea2b6884fa526980 < 25a1669907512e927fab9ad4d4fb74ff57f63cd9 |
| Linux | Linux | 5.3 |