{"id":"CVE-2026-99095","kind":"vulnerability","aliases":["CVE-2026-99095"],"related":[],"title":"Linux kernel VC4 driver: teardown leaves timers running after V3D unbind","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: drain the hangcheck timer and works on V3D unbind\n\nNothing stops the hangcheck timer that submitted jobs arm, or the\njob_done_work that the render-done interrupt queues, at teardown:\nvc4_irq_disable() cancels only overflow_mem_work, and vc4_gem_destroy()\nruns from the drm-managed release, after vc4_v3d_unbind() has already\nuninstalled the V3D interrupt and cleared vc4->v3d. A timer still armed\nby then reads V3D registers through the NULL vc4->v3d pointer, and the\nlate callbacks run on the vc4_dev embedding them after it has been\nfreed.\n\nDrain them in vc4_v3d_unbind(): shut the timer down and cancel\nreset_work before the interrupt is taken down, because its\nvc4_irq_reset() re-enables it, then flush job_done_work so that\ncompletions queued at teardown still release their jobs.\n\nThis issue was found by an in-house static analysis tool.","summary":"In the Linux kernel's VC4 DRM graphics driver for Raspberry Pi, a hangcheck timer and deferred work can still run after the V3D GPU is unbound, reading a NULL pointer or touching freed memory. The sources do not state what an attacker can achieve from this, and the report came from a static analysis tool rather than an exploit.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drm-vc4","linux-kernel","package","raspberry-pi"],"not_affected_if":[],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-26T15:16:48+00:00","first_seen_at":"2026-10-26T16:02:26+00:00","triaged_at":"2026-10-26T16:04:05+00:00","updated_at":"2026-10-26T16:04:05+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-26T16:04:05Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"Linux kernel VC4 driver: teardown leaves timers running after V3D unbind","impact":"medium","summary":"In the Linux kernel's VC4 DRM graphics driver for Raspberry Pi, a hangcheck timer and deferred work can still run after the V3D GPU is unbound, reading a NULL pointer or touching freed memory. The sources do not state what an attacker can achieve from this, and the report came from a static analysis tool rather than an exploit.","category":"package","nicknames":[],"who_cares":["linux-kernel","raspberry-pi","drm-vc4"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; a use-after-free or NULL dereference in kernel context","analyst_note":"Find the fixed kernel stable versions and whether unbinding V3D is reachable by unprivileged users, using the NVD entry CVE-2026-99095 and the upstream kernel commit.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Systems running a Linux kernel with the Raspberry Pi VC4/V3D DRM driver that can unbind the V3D device, such as Raspberry Pi boards. The sources do not say which kernel versions are affected or whether a normal user can trigger the unbind. unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000613,"input_tokens":3572,"output_tokens":512,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-99095':14A,17A 'achiev':72B 'alreadi':155C 'analysi':82B,249C 'arm':116C,167C 'attack':70B 'callback':182C 'came':78B 'cancel':134C,206C 'clear':161C 'complet':231C 'cve':12A,15A 'defer':44B 'destroy':142C 'dev':187C 'disabl':133C 'done':120C,126C,227C 'drain':99C,195C 'driver':4A,36B 'drm':19B,34B,147C 'drm-manag':146C 'drm-vc4':18B 'drm/vc4':98C 'embed':188C 'enabl':222C 'exploit':87B 'flush':225C 'follow':93C 'found':242C 'freed':61B,194C 'gem':141C 'gpu':52B 'graphic':35B 'hangcheck':41B,101C,111C 'hous':247C 'in-hous':245C 'interrupt':127C,159C,211C 'irq':132C,218C 'issu':240C 'job':115C,119C,226C,238C 'kernel':2A,23B,31B,91C 'late':181C 'leav':6A 'linux':1A,22B,30B,90C 'linux-kernel':21B 'manag':148C 'mem':137C 'memori':62B 'noth':108C 'null':57B,175C 'overflow':136C 'packag':24B 'pi':27B,39B 'pointer':58B,178C 'queu':232C 'queue':128C 'raspberri':26B,38B 'raspberry-pi':25B 'rather':84B 're':221C 're-en':220C 'read':55B,170C 'regist':172C 'releas':149C,236C 'render':125C 'render-don':124C 'report':77B 'reset':207C,219C 'resolv':97C 'run':8A,48B,143C,183C 'shut':201C 'sourc':64B 'state':67B 'static':81B,248C 'still':47B,166C,235C 'stop':109C 'submit':114C 'taken':213C 'teardown':5A,130C,234C 'timer':7A,42B,102C,112C,165C,203C 'tool':83B,250C 'touch':60B 'unbind':11A,107C,153C,200C 'unbound':54B 'uninstal':156C 'v3d':10A,51B,106C,152C,158C,163C,171C,177C,199C 'vc4':3A,20B,33B,131C,140C,151C,162C,176C,186C,198C,217C 'vulner':94C 'work':45B,104C,121C,138C,208C,228C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the Raspberry Pi VC4/V3D DRM driver that can unbind the V3D device, such as Raspberry Pi boards. The sources do not say which kernel versions are affected or whether a normal user can trigger the unbind. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T15:16:48+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99095","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99095","severity":null,"published_at":"2026-10-26T15:16:48+00:00","modified_at":"2026-10-26T15:16:48+00:00","first_seen_at":"2026-10-26T16:02:26+00:00","fetched_at":"2026-10-26T16:02:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}