VulnerabilityPublished 26 Oct 2026

CVE-2026-99095: Linux kernel · drm/vc4: drain the hangcheck timer and works on V3D unbind

Source GCVE Database

Authoritative record:CVE-2026-99095· Medium

Not known to be exploited · fixed in e61465d3e0292daebf4dbb34e0add635e2439569 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 16:31 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

Patch: Available – fixed in e61465d3e0292daebf4dbb34e0add635e2439569, ade226dfd28cf2fd1dce143c556d1ee77d953696, a046cd60ff3f4a8c8e672b3b18902682c1f91731 +2

Exploitation evidence

Disclosed: evidence found.
CVE published 26 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-v4rc-4368-fvrr

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ d5b1a78a772f1e31a94f8babfa964152ec5e9aa5, < e61465d3e0292daebf4dbb34e0add635e2439569	Fixed in e61465d3e0292daebf4dbb34e0add635e2439569
LinuxLinux	Affected ≥ d5b1a78a772f1e31a94f8babfa964152ec5e9aa5, < ade226dfd28cf2fd1dce143c556d1ee77d953696	Fixed in ade226dfd28cf2fd1dce143c556d1ee77d953696
LinuxLinux	Affected ≥ d5b1a78a772f1e31a94f8babfa964152ec5e9aa5, < a046cd60ff3f4a8c8e672b3b18902682c1f91731	Fixed in a046cd60ff3f4a8c8e672b3b18902682c1f91731
LinuxLinux	Affected ≥ d5b1a78a772f1e31a94f8babfa964152ec5e9aa5, < 94cf5971b1d04c6382437387c4dc3836cc7a1437	Fixed in 94cf5971b1d04c6382437387c4dc3836cc7a1437
LinuxLinux	Affected ≥ d5b1a78a772f1e31a94f8babfa964152ec5e9aa5, < 17c5fa371de2d5508755cd4cd227cc8e2bb99240	Fixed in 17c5fa371de2d5508755cd4cd227cc8e2bb99240
LinuxLinux	Affected =4.5	Fixed in–

AI-suggested

A fix has been implemented in the Linux kernel to properly drain the hangcheck timer and job_done_work during V3D unbind. Users should update to a kernel version that includes this fix once available.

Description

A vulnerability in the Linux kernel's drm/vc4 driver involves improper handling of the hangcheck timer and job completion work during V3D unbind. The hangcheck timer and job_done_work are not properly stopped or drained before the V3D interrupt is uninstalled and the associated device structure freed. This can lead to timer callbacks accessing freed memory, causing potential use-after-free conditions.

Impact

If exploited, this vulnerability could cause use-after-free conditions leading to kernel crashes or potential escalation of privileges due to accessing freed memory. However, no known exploits in the wild have been reported.

Summary

The Linux kernel's drm/vc4 driver failed to properly drain the hangcheck timer and job_done_work during the V3D unbind process. Specifically, vc4_irq_disable() only cancels overflow_mem_work, and vc4_gem_destroy() runs after vc4_v3d_unbind() has uninstalled the V3D interrupt and cleared the vc4->v3d pointer. As a result, a timer still armed at teardown reads V3D registers through a NULL pointer, and late callbacks execute on a freed vc4_dev structure. The fix involves draining the timer and canceling reset_work before the interrupt is taken down, and flushing job_done_work to ensure proper release of jobs queued at teardown. This issue was identified via an in-house static analysis tool.

References

Community reviews

Loading reviews…