---
id: "CVE-2026-99095"
kind: "vulnerability"
aliases: ["CVE-2026-99095"]
title: "Linux kernel VC4 driver: teardown leaves timers running after V3D unbind"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["drm-vc4", "linux-kernel", "package", "raspberry-pi"]
not_affected_if: []
published_at: "2026-10-26T15:16:48+00:00"
first_seen_at: "2026-10-26T16:02:26+00:00"
updated_at: "2026-10-26T16:04:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99095", "first_seen_at": "2026-10-26T16:02:26+00:00"}]
---

# Linux kernel VC4 driver: teardown leaves timers running after V3D unbind

In the Linux kernel's VC4 DRM graphics driver for Raspberry Pi, a hangcheck timer and deferred work can still run after the V3D GPU is unbound, reading a NULL pointer or touching freed memory. The sources do not state what an attacker can achieve from this, and the report came from a static analysis tool rather than an exploit.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- unknown

## Timeline

- 2026-10-26T16:02:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99095

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

drm/vc4: drain the hangcheck timer and works on V3D unbind

Nothing stops the hangcheck timer that submitted jobs arm, or the
job_done_work that the render-done interrupt queues, at teardown:
vc4_irq_disable() cancels only overflow_mem_work, and vc4_gem_destroy()
runs from the drm-managed release, after vc4_v3d_unbind() has already
uninstalled the V3D interrupt and cleared vc4->v3d. A timer still armed
by then reads V3D registers through the NULL vc4->v3d pointer, and the
late callbacks run on the vc4_dev embedding them after it has been
freed.

Drain them in vc4_v3d_unbind(): shut the timer down and cancel
reset_work before the interrupt is taken down, because its
vc4_irq_reset() re-enables it, then flush job_done_work so that
completions queued at teardown still release their jobs.

This issue was found by an in-house static analysis tool.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_