CVE-2026-68303

What it actually does

Null pointer dereference in vc4_hvs_unbind and vc4_v3d_unbind due to use-after-free of master device driver data after vc4-drm removal.

Why it matters to the business

Kernel crashes or graphics subsystem instability on affected Linux systems, leading to downtime for display and rendering workloads with low exploit likelihood.

How an attack unfolds

An attacker triggers device or module unbind sequences on systems using vc4 drm drivers, causing the unbind handlers to dereference freed memory; no known threat actors or ransomware campaigns.

How to fix it

Apply the upstream Linux kernel patch that modifies vc4_hvs_unbind and vc4_v3d_unbind to use the passed data pointer directly instead of dev_get_drvdata(master).

How to confirm the fix worked

Inspect kernel source for the updated unbind functions, confirm absence of dev_get_drvdata calls on master device, and test driver load/unload cycles for stability.

Typical attack path

1. Gain local access to trigger kernel module load/unload or device removal
2. Force unbind of vc4-drm before dependent hvs/v3d drivers
3. Trigger null dereference in unbind functions leading to kernel panic

How to detect it

Review kernel logs and oops reports for references to vc4_hvs_unbind, vc4_v3d_unbind, or null pointer dereferences during drm device unbind.

What your security team should do

• Prioritize kernel updates on systems with VC4 graphics hardware
• Monitor kernel logs for drm/vc4 related oops during module removal
• Restrict unprivileged module loading where possible