---
id: "CVE-2026-98946"
kind: "vulnerability"
aliases: ["CVE-2026-98946"]
title: "Linux kernel: VC4 display driver race on Raspberry Pi 0-3 power-down"
severity: "unknown"
cvss: null
epss: 0.00198
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["drm", "linux-kernel", "raspberry-pi", "runtime", "vc4"]
not_affected_if: ["non-raspberry-pi-hardware", "vc4-not-loaded"]
published_at: "2026-10-23T13:17:15+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98946", "first_seen_at": "2026-10-23T21:57:33+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-98946", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# Linux kernel: VC4 display driver race on Raspberry Pi 0-3 power-down

A race in the Linux kernel's vc4 graphics driver on Raspberry Pi 0-3 lets an interrupt run after the GPU is powered off, reading bogus 0xdeadbeef register values. The fix disables the V3D interrupt line across runtime suspend; the sources do not describe a confirmed attacker payload.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `uname -r` and compare it with the fixed kernel version listed in the NVD entry (unknown in the sources).
- Check whether the board is a Raspberry Pi 0-3 using the vc4 driver: `lsmod | grep vc4`.

## Fix

- Update the Linux kernel to a release that includes the upstream commit 'drm/vc4: Disable the V3D interrupt across runtime suspend' (exact version unknown in the sources).

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98946
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-98946

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

drm/vc4: Disable the V3D interrupt across runtime suspend

vc4_irq_disable() masks the V3D interrupt sources and then calls
synchronize_irq() before the V3D is powered down. However, by itself,
this is not enough to quiesce the interrupt handler.

synchronize_irq() waits for handlers that have already set
IRQD_IRQ_INPROGRESS, and for irqchips reporting IRQCHIP_STATE_ACTIVE.
A GIC interrupt chip is able to mark an interrupt active as soon as a
CPU acknowledges it, so there these checks cover the whole dispatch path.
On RPi 0-3, however, the interrupt controller is ARMCTRL, which has no
active state. A CPU that has read the hwirq out of the pending register
but has not yet reached handle_level_irq() stays invisible to
synchronize_irq().

During a power transition, vc4_irq() may therefore run after the power
domain is off, where every V3D register read will return 0xdeadbeef.
0xdeadbeef has FLDONE, FRDONE and OUTOMEM set. This problem doesn't
trigger NULL pointer dereference issues only because the functions
vc4_irq_finish_bin_job() and vc4_irq_finish_render_job() return early
when there is no job pointer, but OUTOMEM is still able to schedule
vc4_overflow_mem_work() after vc4_irq_disable() has already cancelled it.

Therefore, fix the spurious interrupts by disabling the interrupt line
across the PM transition. To preserve the enable/disable balance, move
vc4_irq_install() and request the IRQ line disabled before the first
runtime resume.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_