CVE-2026-46314

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/v3d: Reject empty multisync extension to prevent infinite loop

v3d_get_extensions() walks a userspace-provided singly-linked list of

ioctl extensions without any bound on the chain length. A local user

can craft a self-referential extension (ext->next == &ext) with zero

in_sync_count and out_sync_count, which bypasses the existing duplicate-

extension guard:

if (se->in_sync_count || se->out_sync_count)

return -EINVAL;

The guard never fires because v3d_get_multisync_post_deps() returns

immediately when count is zero, leaving both fields at zero on every

iteration. The result is an infinite loop in kernel context, blocking

the calling thread and pegging a CPU core indefinitely.

Fix this by rejecting a multisync extension where both in_sync_count

and out_sync_count are zero in v3d_get_multisync_submit_deps(). An

empty multisync carries no synchronization information and serves no

useful purpose, s

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References