Cloudanix VulnDB

CVE-2026-98946

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing flaw in the graphics driver on certain Raspberry Pi devices can let an interrupt fire at the wrong moment during power saving, leading to instability or crashes.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Race condition in vc4 driver allows vc4_irq handler to execute after V3D power domain is disabled on ARMCTRL-based platforms, causing reads of powered-down registers to return 0xdeadbeef and potentially scheduling cancelled work items.

Why it matters to the business

Unexpected system instability or crashes during graphics power transitions on affected embedded devices, with elevated urgency due to publication only 2 days ago and ongoing kernel exposure in the graphics stack.

How an attack unfolds

An attacker with local access triggers runtime suspend/resume cycles on the vc4 device while simultaneously generating V3D interrupts; the unsynchronized handler then runs against a powered-down device and performs unsafe register accesses or work scheduling.

How to fix it

Update to a Linux kernel containing the commit that disables the V3D interrupt line across the entire PM transition and moves vc4_irq_install to request the line disabled before first runtime resume.

How to confirm the fix worked

Confirm the presence of the upstream fix that calls disable_irq across suspend and re-enables after resume; verify no 0xdeadbeef register patterns appear in dmesg during graphics PM cycles.

Typical attack path

  1. Obtain local execution on a Raspberry Pi 0-3 class device using vc4 DRM driver
  2. Force repeated runtime PM suspend/resume transitions on the graphics device
  3. Generate V3D interrupt events during the narrow window between irq_disable and power-off
  4. Trigger execution of the stale interrupt handler against deadbeef register values

How to detect it

Review dmesg and kernel logs for vc4_irq activity coinciding with runtime suspend events or messages referencing 0xdeadbeef register values and vc4_overflow_mem_work scheduling after disable.

What your security team should do

  • Prioritize kernel updates for all vc4-based Raspberry Pi systems within the next maintenance window
  • Monitor EPSS and exploit maturity for any increase over the coming weeks
  • Add runtime PM stress testing to CI for graphics drivers on ARMCTRL platforms

The record

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Disable the V3D interrupt across runtime suspend vc4_irq_disable() masks the V3D interrupt sources and then calls synchronize_irq() before the V3D is powered down. However, by itself, this is not enough to quiesce the interrupt handler. synchronize_irq() waits for handlers that have already set IRQD_IRQ_INPROGRESS, and for irqchips reporting IRQCHIP_STATE_ACTIVE. A GIC interrupt chip is able to mark an interrupt active as soon as a CPU acknowledges it, so there these checks cover the whole dispatch path. On RPi 0-3, however, the interrupt controller is ARMCTRL, which has no active state. A CPU that has read the hwirq out of the pending register but has not yet reached handle_level_irq() stays invisible to synchronize_irq(). During a power transition, vc4_irq() may therefore run after the power domain is off, where every V3D register read will return 0xdeadbeef. 0xdeadbeef has FLDONE, FRDONE and OUTOMEM set. This problem doesn't trigger NULL pointer dereference issues only because the functions vc4_irq_finish_bin_job() and vc4_irq_finish_render_job() return early when there is no job pointer, but OUTOMEM is still able to schedule vc4_overflow_mem_work() after vc4_irq_disable() has already cancelled it. Therefore, fix the spurious interrupts by disabling the interrupt line across the PM transition. To preserve the enable/disable balance, move vc4_irq_install() and request the IRQ line disabled before the first runtime resume.

Affected packages

Ecosystem Package Introduced Fixed