Live › vulnerability › CVE-2026-99095
Go to dashboardIn the Linux kernel's VC4 DRM graphics driver for Raspberry Pi, a hangcheck timer and deferred work can still run after the V3D GPU is unbound, reading a NULL pointer or touching freed memory. The sources do not state what an attacker can achieve from this, and the report came from a static analysis tool rather than an exploit.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 16:02 UTC. All times on this page are UTC.
Systems running a Linux kernel with the Raspberry Pi VC4/V3D DRM driver that can unbind the V3D device, such as Raspberry Pi boards. The sources do not say which kernel versions are affected or whether a normal user can trigger the unbind. unknown
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
drm/vc4: drain the hangcheck timer and works on V3D unbind
Nothing stops the hangcheck timer that submitted jobs arm, or the job_done_work that the render-done interrupt queues, at teardown: vc4_irq_disable() cancels only overflow_mem_work, and vc4_gem_destroy() runs from the drm-managed release, after vc4_v3d_unbind() has already uninstalled the V3D interrupt and cleared vc4->v3d. A timer still armed by then reads V3D registers through the NULL vc4->v3d pointer, and the late callbacks run on the vc4_dev embedding them after it has been freed.
Drain them in vc4_v3d_unbind(): shut the timer down and cancel reset_work before the interrupt is taken down, because its vc4_irq_reset() re-enables it, then flush job_done_work so that completions queued at teardown still release their jobs.
This issue was found by an in-house static analysis tool.
This page as .md · .json · in your agent: get_signal("CVE-2026-99095")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.