CVE-2026-64099

High · 7.8

CVSS

7.8

EPSS

0.1%

Published

Jul 19, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in Linux graphics handling can let someone who already has access to the computer crash it or take full control.

Exploitation: Local Privilege
Attacker needs: Low Privilege
Complexity: Low
Impact: Full Compromise
Component: OS kernel
Class: Use After Free
Remediation: Patch
Effort: Medium
Patch risk: Low

What it actually does

The vulnerability is a use-after-free of CPU job query arrays (timestamp and performance) on the ioctl error path after v3d_job_cleanup drops the last reference; it also causes a NULL dereference on early v3d_job_init failure and leaks drm_syncobj references because manual kvfree skips the proper free functions used on the success path.

Why it matters to the business

Local attackers on affected Linux systems can crash the kernel or potentially escalate privileges, resulting in denial of service or full system compromise on machines using the v3d DRM driver.

How an attack unfolds

An attacker with local access submits a crafted CPU job ioctl that forces an error before the job reaches the scheduler; the flawed fail label then accesses the already-freed cpu_job structure, enabling memory corruption that can be turned into arbitrary kernel code execution.

How to fix it

Apply the upstream fix that unifies CPU job teardown inside the kref destructor (mirroring v3d_render_job_free) and restores the generic v3d_sched_job_free callback; rebuild and deploy the patched kernel on all affected systems.

How to confirm the fix worked

Confirm the presence of the unified kref destructor and removal of the manual kvfree calls in the v3d CPU job error path; test that both success and error paths reach the same teardown logic without accessing freed memory or leaking syncobjs.

Typical attack path

Gain local unprivileged access to a Linux system running the vulnerable v3d driver
Invoke the CPU job ioctl with parameters that trigger an early error path
Trigger the use-after-free or NULL dereference during manual teardown
Leverage the resulting memory corruption for privilege escalation or denial of service

How to detect it

Search kernel logs and crash dumps for v3d_job_cleanup, v3d_timestamp_query_info_free, or v3d_performance_query_info_free entries that coincide with use-after-free or NULL pointer dereference reports; examine audit logs for unusual CPU job ioctl activity from unprivileged processes.

What your security team should do

Prioritize kernel updates for any system exposing the v3d driver to local users
Restrict untrusted local access until patches are deployed
Monitor kernel logs for v3d-related oops or use-after-free warnings
Audit downstream distributions for backported fixes given the high CVSS and local impact

The record

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Fix use-after-free of CPU job query arrays on error path The CPU job ioctl's fail label calls kvfree() on cpu_job's timestamp and performance query arrays after v3d_job_cleanup(), which drops the job's last reference and frees cpu_job. Reading cpu_job at that point is a use-after-free. Also, on the early v3d_job_init() failure path, it is a NULL dereference, since v3d_job_deallocate() zeroes the local pointer. In the success path, the arrays are released from the scheduler's .free_job callback, but on the error path, they are freed manually, as the job was never pushed to the scheduler. While the success path deals with this correctly, the fail path doesn't. On top of that, the manual kvfree() calls only free the array storage; they don't drm_syncobj_put() the per-query syncobjs that v3d_timestamp_query_info_free() and v3d_performance_query_info_free() release on the success path. So the same fail path that triggers the use-after-free also leaks one syncobj reference per query. Unify the CPU job teardown into the CPU job's kref destructor, mirroring v3d_render_job_free(). The scheduler's .free_job slot reverts to the generic v3d_sched_job_free() and the fail label drops the manual kvfree() calls, leaving a single teardown path that is reached from both the scheduler and the ioctl error path. That removes the use-after-free, the NULL dereference, and the syncobj leak by construction.

Affected packages

Ecosystem	Package	Introduced	Fixed