{"id":"CVE-2026-98946","kind":"vulnerability","aliases":["CVE-2026-98946"],"related":[],"title":"Linux kernel: VC4 display driver race on Raspberry Pi 0-3 power-down","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: Disable the V3D interrupt across runtime suspend\n\nvc4_irq_disable() masks the V3D interrupt sources and then calls\nsynchronize_irq() before the V3D is powered down. However, by itself,\nthis is not enough to quiesce the interrupt handler.\n\nsynchronize_irq() waits for handlers that have already set\nIRQD_IRQ_INPROGRESS, and for irqchips reporting IRQCHIP_STATE_ACTIVE.\nA GIC interrupt chip is able to mark an interrupt active as soon as a\nCPU acknowledges it, so there these checks cover the whole dispatch path.\nOn RPi 0-3, however, the interrupt controller is ARMCTRL, which has no\nactive state. A CPU that has read the hwirq out of the pending register\nbut has not yet reached handle_level_irq() stays invisible to\nsynchronize_irq().\n\nDuring a power transition, vc4_irq() may therefore run after the power\ndomain is off, where every V3D register read will return 0xdeadbeef.\n0xdeadbeef has FLDONE, FRDONE and OUTOMEM set. This problem doesn't\ntrigger NULL pointer dereference issues only because the functions\nvc4_irq_finish_bin_job() and vc4_irq_finish_render_job() return early\nwhen there is no job pointer, but OUTOMEM is still able to schedule\nvc4_overflow_mem_work() after vc4_irq_disable() has already cancelled it.\n\nTherefore, fix the spurious interrupts by disabling the interrupt line\nacross the PM transition. To preserve the enable/disable balance, move\nvc4_irq_install() and request the IRQ line disabled before the first\nruntime resume.","summary":"A race in the Linux kernel's vc4 graphics driver on Raspberry Pi 0-3 lets an interrupt run after the GPU is powered off, reading bogus 0xdeadbeef register values. The fix disables the V3D interrupt line across runtime suspend; the sources do not describe a confirmed attacker payload.","severity":"unknown","cvss":null,"epss":0.00198,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drm","linux-kernel","raspberry-pi","runtime","vc4"],"not_affected_if":["non-raspberry-pi-hardware","vc4-not-loaded"],"how_to_check":"- Run `uname -r` and compare it with the fixed kernel version listed in the NVD entry (unknown in the sources).\n- Check whether the board is a Raspberry Pi 0-3 using the vc4 driver: `lsmod | grep vc4`.","fix":"- Update the Linux kernel to a release that includes the upstream commit 'drm/vc4: Disable the V3D interrupt across runtime suspend' (exact version unknown in the sources).","status":"open","published_at":"2026-10-23T13:17:15+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:57:59+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-25T04:57:59Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit 'drm/vc4: Disable the V3D interrupt across runtime suspend' (exact version unknown in the sources).","reach":"local","title":"Linux kernel: VC4 display driver race on Raspberry Pi 0-3 power-down","impact":"low","summary":"A race in the Linux kernel's vc4 graphics driver on Raspberry Pi 0-3 lets an interrupt run after the GPU is powered off, reading bogus 0xdeadbeef register values. The fix disables the V3D interrupt line across runtime suspend; the sources do not describe a confirmed attacker payload.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","raspberry-pi","vc4","drm"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; likely kernel instability or a spurious interrupt path","analyst_note":"Confirm the fixed kernel version and whether any exploitation beyond the race is possible, from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-98946.","how_to_check":"- Run `uname -r` and compare it with the fixed kernel version listed in the NVD entry (unknown in the sources).\n- Check whether the board is a Raspberry Pi 0-3 using the vc4 driver: `lsmod | grep vc4`.","needs_analyst":true,"not_affected_if":["non-raspberry-pi-hardware","vc4-not-loaded"],"who_is_affected":"Only Raspberry Pi 0-3 class boards (ARMCTRL interrupt controller) running a kernel with the vc4 DRM driver and runtime power management. Systems on other hardware, or without the vc4 driver loaded, are not exposed by this description. The sources do not describe a remote trigger.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000723,"input_tokens":3812,"output_tokens":684,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-3':11A,43B,176C '-98946':16A,19A '0':10A,42B,175C '0xdeadbeef':56B,235C,236C 'abl':151C,279C 'acknowledg':162C 'across':66B,93C,304C 'activ':145C,156C,186C 'alreadi':134C,291C 'armctrl':182C 'attack':76B 'balanc':312C 'bin':259C 'bogus':55B 'call':106C 'cancel':292C 'check':167C 'chip':149C 'confirm':75B 'control':180C 'cover':168C 'cpu':161C,189C 'cve':14A,17A 'derefer':250C 'describ':73B 'disabl':61B,89C,98C,289C,300C,322C 'dispatch':171C 'display':4A 'doesn':245C 'domain':225C 'driver':5A,38B 'drm':20B 'drm/vc4':88C 'earli':268C 'enable/disable':311C 'enough':121C 'everi':229C 'finish':258C,264C 'first':325C 'fix':60B,295C 'fldone':238C 'follow':83C 'frdone':239C 'function':255C 'gic':147C 'gpu':50B 'graphic':37B 'handl':205C 'handler':126C,131C 'howev':115C,177C 'hwirq':194C 'inprogress':138C 'instal':316C 'interrupt':46B,64B,92C,102C,125C,148C,155C,179C,298C,302C 'invis':209C 'irq':97C,108C,128C,137C,207C,212C,218C,257C,263C,288C,315C,320C 'irqchip':141C,143C 'irqd':136C 'issu':251C 'job':260C,266C,273C 'kernel':2A,23B,34B,81C 'let':44B 'level':206C 'line':65B,303C,321C 'linux':1A,22B,33B,80C 'linux-kernel':21B 'mark':153C 'mask':99C 'may':219C 'mem':284C 'move':313C 'null':248C 'outomem':241C,276C 'overflow':283C 'path':172C 'payload':77B 'pend':198C 'pi':9A,26B,41B 'pm':306C 'pointer':249C,274C 'power':13A,52B,113C,215C,224C 'power-down':12A 'preserv':309C 'problem':244C 'quiesc':123C 'race':6A,30B 'raspberri':8A,25B,40B 'raspberry-pi':24B 'reach':204C 'read':54B,192C,232C 'regist':57B,199C,231C 'render':265C 'report':142C 'request':318C 'resolv':87C 'resum':327C 'return':234C,267C 'rpi':174C 'run':47B,221C 'runtim':27B,67B,94C,326C 'schedul':281C 'set':135C,242C 'soon':158C 'sourc':70B,103C 'spurious':297C 'state':144C,187C 'stay':208C 'still':278C 'suspend':68B,95C 'synchron':107C,127C,211C 'therefor':220C,294C 'transit':216C,307C 'trigger':247C 'v3d':63B,91C,101C,111C,230C 'valu':58B 'vc4':3A,28B,36B,96C,217C,256C,262C,282C,287C,314C 'vulner':84C 'wait':129C 'whole':170C 'work':285C 'yet':203C","nicknames":[],"mitigations":[],"who_affected":"Only Raspberry Pi 0-3 class boards (ARMCTRL interrupt controller) running a kernel with the vc4 DRM driver and runtime power management. Systems on other hardware, or without the vc4 driver loaded, are not exposed by this description. The sources do not describe a remote trigger.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:15+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98946","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98946","severity":null,"published_at":"2026-10-23T13:17:15+00:00","modified_at":"2026-10-23T13:17:15+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98946","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98946","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}