CVE-2026-64099

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/v3d: Fix use-after-free of CPU job query arrays on error path

The CPU job ioctl's fail label calls kvfree() on cpu_job's timestamp and

performance query arrays after v3d_job_cleanup(), which drops the job's

last reference and frees cpu_job. Reading cpu_job at that point is a

use-after-free. Also, on the early v3d_job_init() failure path, it is a

NULL dereference, since v3d_job_deallocate() zeroes the local pointer.

In the success path, the arrays are released from the scheduler's

.free_job callback, but on the error path, they are freed manually, as

the job was never pushed to the scheduler. While the success path deals

with this correctly, the fail path doesn't.

On top of that, the manual kvfree() calls only free the array storage;

they don't drm_syncobj_put() the per-query syncobjs that

v3d_timestamp_query_info_free() and v3d_performance_query_info_free()

release on the success path. So the same fail path tha

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References