The Linux kernel's drm/v3d component had a vulnerability where the function v3d_get_extensions() walked a user-controlled singly-linked list of ioctl extensions without limiting the chain length. A local attacker could craft a self-referential extension with in_sync_count and out_sync_count both set to zero, bypassing the duplicate-extension guard and causing an infinite loop in kernel context. This loop blocks the calling thread and consumes a CPU core indefinitely. The fix involves rejecting multisync extensions with zero synchronization counts in v3d_get_multisync_submit_deps(), returning -EINVAL to prevent this attack vector.

A local user can exploit this vulnerability to cause an infinite loop in kernel context, leading to a denial of service by blocking the calling thread and pegging a CPU core indefinitely. There is no indication of privilege escalation or data corruption from the provided information.

A fix is available that rejects multisync extensions with zero in_sync_count and out_sync_count, preventing the infinite loop. Users should update to Linux kernel versions 7.0.0-28.28.1 or later where this vulnerability is resolved. Patch status is confirmed by the presence of affected versions less than 7.0.0-28.28.1 and the description of the fix.