In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Fix use-after-free of CPU job query arrays on error path The CPU job… (CVE-2026-64099)
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Fix use-after-free of CPU job query arrays on error path The CPU job ioctl's fail label calls kvfree() on cpu_job's timestamp and performance query arrays after v3d_job_cleanup(), which drops the job's last reference and frees cpu_job. Reading cpu_job at that point is a use-after-free. Also, on the early v3d_job_init() failure path, it is a NULL dereference, since v3d_job_deallocate() zeroes the local pointer. In the success path, the arrays are released from the scheduler's .free_job callback, but on the error path, they are freed manually, as the job was never pushed to the scheduler. While the success path deals with this correctly, the fail path doesn't. On top of that, the manual kvfree() calls only free the array storage; they don't drm_syncobj_put() the per-query syncobjs that v3d_timestamp_query_info_free() and v3d_performance_query_info_free() release on the success path. So the same fail path that triggers the use-after-free also leaks one syncobj reference per query. Unify the CPU job teardown into the CPU job's kref destructor, mirroring v3d_render_job_free(). The scheduler's .free_job slot reverts to the generic v3d_sched_job_free() and the fail label drops the manual kvfree() calls, leaving a single teardown path that is reached from both the scheduler and the ioctl error path. That removes the use-after-free, the NULL dereference, and the syncobj leak by construction.
AI Analysis
Technical Summary
The Linux kernel's drm/v3d driver had a vulnerability (CVE-2026-64099) where the CPU job ioctl's error handling path incorrectly freed CPU job query arrays after the job was already freed, causing a use-after-free condition. Additionally, on early initialization failure, a NULL pointer dereference could occur. The error path also leaked sync object references because manual freeing did not release these objects properly. The fix involved consolidating the CPU job teardown into the job's reference-counted destructor, eliminating the manual frees on the error path and ensuring consistent cleanup whether the job was scheduled or failed early.
Potential Impact
The vulnerability could lead to use-after-free memory errors and NULL pointer dereferences within the drm/v3d driver, potentially causing kernel crashes or instability. It also caused resource leaks of synchronization objects. There is no indication of known exploits in the wild. The impact is primarily on system stability and resource management within the affected kernel component.
Mitigation Recommendations
A fix has been implemented upstream in the Linux kernel by unifying the CPU job teardown process to prevent use-after-free, NULL dereference, and resource leaks. Users should update to a Linux kernel version that includes this fix. Since this is a kernel vulnerability, applying the official kernel update from the vendor or distribution is the recommended remediation. Patch status is not explicitly confirmed here; check the vendor or distribution advisory for the exact fixed kernel versions and update accordingly.
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Fix use-after-free of CPU job query arrays on error path The CPU job… (CVE-2026-64099)
Description
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Fix use-after-free of CPU job query arrays on error path The CPU job ioctl's fail label calls kvfree() on cpu_job's timestamp and performance query arrays after v3d_job_cleanup(), which drops the job's last reference and frees cpu_job. Reading cpu_job at that point is a use-after-free. Also, on the early v3d_job_init() failure path, it is a NULL dereference, since v3d_job_deallocate() zeroes the local pointer. In the success path, the arrays are released from the scheduler's .free_job callback, but on the error path, they are freed manually, as the job was never pushed to the scheduler. While the success path deals with this correctly, the fail path doesn't. On top of that, the manual kvfree() calls only free the array storage; they don't drm_syncobj_put() the per-query syncobjs that v3d_timestamp_query_info_free() and v3d_performance_query_info_free() release on the success path. So the same fail path that triggers the use-after-free also leaks one syncobj reference per query. Unify the CPU job teardown into the CPU job's kref destructor, mirroring v3d_render_job_free(). The scheduler's .free_job slot reverts to the generic v3d_sched_job_free() and the fail label drops the manual kvfree() calls, leaving a single teardown path that is reached from both the scheduler and the ioctl error path. That removes the use-after-free, the NULL dereference, and the syncobj leak by construction.
CVSS v3.1
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel's drm/v3d driver had a vulnerability (CVE-2026-64099) where the CPU job ioctl's error handling path incorrectly freed CPU job query arrays after the job was already freed, causing a use-after-free condition. Additionally, on early initialization failure, a NULL pointer dereference could occur. The error path also leaked sync object references because manual freeing did not release these objects properly. The fix involved consolidating the CPU job teardown into the job's reference-counted destructor, eliminating the manual frees on the error path and ensuring consistent cleanup whether the job was scheduled or failed early.
Potential Impact
The vulnerability could lead to use-after-free memory errors and NULL pointer dereferences within the drm/v3d driver, potentially causing kernel crashes or instability. It also caused resource leaks of synchronization objects. There is no indication of known exploits in the wild. The impact is primarily on system stability and resource management within the affected kernel component.
Mitigation Recommendations
A fix has been implemented upstream in the Linux kernel by unifying the CPU job teardown process to prevent use-after-free, NULL dereference, and resource leaks. Users should update to a Linux kernel version that includes this fix. Since this is a kernel vulnerability, applying the official kernel update from the vendor or distribution is the recommended remediation. Patch status is not explicitly confirmed here; check the vendor or distribution advisory for the exact fixed kernel versions and update accordingly.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-6q8x-m3wr-crj5
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64099"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a5d27a92a4a8d598912bbb1
Added to database: 07/19/2026, 19:38:17 UTC
Last enriched: 07/19/2026, 19:49:35 UTC
Last updated: 07/20/2026, 19:41:21 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.