Cloudanix VulnDB

CVE-2026-68233

None

CVSS

—

EPSS

0.2%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing flaw in Linux graphics handling for certain video hardware could let a program on the same computer crash the system or run unauthorized code.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Race condition during vc4 BO cache teardown where timer callback can rearm time_work and work can rearm the timer, bypassing cancel_work_sync and leaving dangling references after module unload.

Why it matters to the business

Kernel instability, potential crashes, or local privilege escalation on systems using vc4 DRM; low but non-zero exploitation probability requires patching to avoid operational disruption.

How an attack unfolds

Local attacker triggers repeated vc4 BO cache operations followed by module teardown or driver unload, racing the timer-work cycle to access freed memory structures.

How to fix it

Apply kernel patches that replace timer deletion with timer_shutdown_sync before cancel_work_sync in vc4_bo_cache_destroy; rebuild and reboot with fixed kernel.

How to confirm the fix worked

Inspect vc4_bo.c for timer_shutdown_sync call in cache destroy path and confirm no post-teardown timer re-arming is possible via code review or dynamic tracing.

Typical attack path

  1. Obtain local unprivileged access on Linux system with vc4 driver loaded
  2. Allocate and free BO objects to populate cache
  3. Trigger vc4_bo_cache_destroy via module unload or device removal
  4. Race timer and work cancellation to trigger use-after-free

How to detect it

Review kernel logs for vc4-related oops, warnings about timer/work re-arming, or use-after-free reports during module unload or shutdown sequences.

What your security team should do

  • Prioritize kernel upgrade on all vc4-equipped systems within standard patch windows
  • Monitor vendor kernel release notes for vc4 fixes
  • Test driver unload paths in staging environments before production rollout

The record

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Shut down BO cache timer before teardown The BO cache timer callback schedules time_work, and time_work can rearm the timer through vc4_bo_cache_free_old(). vc4_bo_cache_destroy() deletes the timer and then cancels the work, which does not break that cycle: the work being cancelled can rearm the timer, and the timer then queues work again after teardown. Use timer_shutdown_sync() instead, so the timer cannot be rearmed and the cycle ends with cancel_work_sync().

Affected packages

Ecosystem Package Introduced Fixed