Cloudanix VulnDB

CVE-2026-99095

None

CVSS

—

EPSS

0.2%

Published

Oct 26, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A graphics driver bug in Linux can cause the system to crash when hardware is being shut down if work is still running in the background.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in drm/vc4 where an armed hangcheck timer and job_done_work continue to execute after vc4_v3d_unbind clears the v3d pointer and frees the embedding structure, allowing NULL dereference or access to freed memory.

Why it matters to the business

Kernel instability or crashes on systems with VC4/V3D graphics hardware during driver unload or device removal, potentially affecting embedded Linux devices and increasing operational downtime.

How an attack unfolds

An attacker with local access triggers repeated bind/unbind cycles or driver unload while render jobs are queued; the still-armed timer then dereferences a NULL v3d pointer or the late work callbacks run against already-freed memory.

How to fix it

Apply the upstream fix that drains the hangcheck timer, cancels reset_work, and flushes job_done_work inside vc4_v3d_unbind before interrupts are disabled.

How to confirm the fix worked

Confirm the presence of the drain logic in vc4_v3d_unbind and that vc4_irq_disable plus vc4_gem_destroy no longer race with pending timers or work items.

Typical attack path

  1. Obtain local code execution on a system using the vc4 driver
  2. Force device unbind or module removal while jobs remain pending
  3. Trigger the hangcheck timer or job_done_work after vc4->v3d is cleared
  4. Cause NULL dereference or use-after-free leading to kernel panic

How to detect it

Inspect kernel logs for NULL pointer dereferences or use-after-free reports mentioning vc4_irq, hangcheck, or v3d during module unload or device unbind events.

What your security team should do

  • Prioritize kernel updates containing the vc4 unbind drain fix on all VC4/V3D systems
  • Monitor for kernel oops or panic logs referencing vc4 or v3d during device removal
  • Limit unprivileged access to graphics device nodes until patched

The record

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: drain the hangcheck timer and works on V3D unbind Nothing stops the hangcheck timer that submitted jobs arm, or the job_done_work that the render-done interrupt queues, at teardown: vc4_irq_disable() cancels only overflow_mem_work, and vc4_gem_destroy() runs from the drm-managed release, after vc4_v3d_unbind() has already uninstalled the V3D interrupt and cleared vc4->v3d. A timer still armed by then reads V3D registers through the NULL vc4->v3d pointer, and the late callbacks run on the vc4_dev embedding them after it has been freed. Drain them in vc4_v3d_unbind(): shut the timer down and cancel reset_work before the interrupt is taken down, because its vc4_irq_reset() re-enables it, then flush job_done_work so that completions queued at teardown still release their jobs. This issue was found by an in-house static analysis tool.

Affected packages

Ecosystem Package Introduced Fixed