CVE-2026-74638

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/v3d: Serialize the scheduler timeout handlers

V3D exposes several independent hardware queues (BIN, RENDER, TFU and

CSD) but has only a single, global reset. A timeout on any one queue

therefore has to stop, reset and restart the schedulers of every other

queue as well. That makes concurrent timeout handlers unsafe.

`reset_lock` was never able to make them safe, as a driver-side lock can

only cover the driver's &drm_sched_backend_ops.timedout_job callback.

The scheduler handles the timed out job and its pending list around that

callback, outside of the driver's control, so a global reset triggered

by one queue can still interfere with another queue that is in the

middle of handling a timeout of its own.

Consequently, if a reset happens in the CSD queue while a CL-intensive

application is running, the global reset stops and restarts the CL

queue's scheduler while that queue is handling a timeout of its own. As

d

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References