{"api_version":"1","generated_at":"2026-07-20T14:42:09+00:00","cve":"CVE-2026-64099","urls":{"html":"https://cve.report/CVE-2026-64099","api":"https://cve.report/api/cve/CVE-2026-64099.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-64099","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-64099"},"summary":{"title":"drm/v3d: Fix use-after-free of CPU job query arrays on error path","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Fix use-after-free of CPU job query arrays on error path\n\nThe CPU job ioctl's fail label calls kvfree() on cpu_job's timestamp and\nperformance query arrays after v3d_job_cleanup(), which drops the job's\nlast reference and frees cpu_job. Reading cpu_job at that point is a\nuse-after-free. Also, on the early v3d_job_init() failure path, it is a\nNULL dereference, since v3d_job_deallocate() zeroes the local pointer.\n\nIn the success path, the arrays are released from the scheduler's\n.free_job callback, but on the error path, they are freed manually, as\nthe job was never pushed to the scheduler. While the success path deals\nwith this correctly, the fail path doesn't.\n\nOn top of that, the manual kvfree() calls only free the array storage;\nthey don't drm_syncobj_put() the per-query syncobjs that\nv3d_timestamp_query_info_free() and v3d_performance_query_info_free()\nrelease on the success path. So the same fail path that triggers the\nuse-after-free also leaks one syncobj reference per query.\n\nUnify the CPU job teardown into the CPU job's kref destructor, mirroring\nv3d_render_job_free(). The scheduler's .free_job slot reverts to the\ngeneric v3d_sched_job_free() and the fail label drops the manual\nkvfree() calls, leaving a single teardown path that is reached from both\nthe scheduler and the ioctl error path. That removes the use-after-free,\nthe NULL dereference, and the syncobj leak by construction.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-07-19 16:17:50","updated_at":"2026-07-19 16:17:50"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/69c2a1fec2e7ca25598180816f3bc56e1842eb41","name":"https://git.kernel.org/stable/c/69c2a1fec2e7ca25598180816f3bc56e1842eb41","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/0f8efc45740b0628a787d1b0be8a0ddabd700625","name":"https://git.kernel.org/stable/c/0f8efc45740b0628a787d1b0be8a0ddabd700625","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/b0fe80c0b9250b35e2211bf3117e7aca814a21b0","name":"https://git.kernel.org/stable/c/b0fe80c0b9250b35e2211bf3117e7aca814a21b0","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/acd55ea40d03e06f20a9986363019e0e5173990e","name":"https://git.kernel.org/stable/c/acd55ea40d03e06f20a9986363019e0e5173990e","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-64099","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64099","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 9ba0ff3e083f6a4a0b6698f06bfff74805fefa5f acd55ea40d03e06f20a9986363019e0e5173990e git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 9ba0ff3e083f6a4a0b6698f06bfff74805fefa5f 0f8efc45740b0628a787d1b0be8a0ddabd700625 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 9ba0ff3e083f6a4a0b6698f06bfff74805fefa5f 69c2a1fec2e7ca25598180816f3bc56e1842eb41 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 9ba0ff3e083f6a4a0b6698f06bfff74805fefa5f b0fe80c0b9250b35e2211bf3117e7aca814a21b0 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.8","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.8 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.93 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.34 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.0.11 7.0.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/v3d/v3d_sched.c","drivers/gpu/drm/v3d/v3d_submit.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"acd55ea40d03e06f20a9986363019e0e5173990e","status":"affected","version":"9ba0ff3e083f6a4a0b6698f06bfff74805fefa5f","versionType":"git"},{"lessThan":"0f8efc45740b0628a787d1b0be8a0ddabd700625","status":"affected","version":"9ba0ff3e083f6a4a0b6698f06bfff74805fefa5f","versionType":"git"},{"lessThan":"69c2a1fec2e7ca25598180816f3bc56e1842eb41","status":"affected","version":"9ba0ff3e083f6a4a0b6698f06bfff74805fefa5f","versionType":"git"},{"lessThan":"b0fe80c0b9250b35e2211bf3117e7aca814a21b0","status":"affected","version":"9ba0ff3e083f6a4a0b6698f06bfff74805fefa5f","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/v3d/v3d_sched.c","drivers/gpu/drm/v3d/v3d_submit.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.8"},{"lessThan":"6.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.93","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.34","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.93","versionStartIncluding":"6.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.34","versionStartIncluding":"6.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.0.11","versionStartIncluding":"6.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1","versionStartIncluding":"6.8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Fix use-after-free of CPU job query arrays on error path\n\nThe CPU job ioctl's fail label calls kvfree() on cpu_job's timestamp and\nperformance query arrays after v3d_job_cleanup(), which drops the job's\nlast reference and frees cpu_job. Reading cpu_job at that point is a\nuse-after-free. Also, on the early v3d_job_init() failure path, it is a\nNULL dereference, since v3d_job_deallocate() zeroes the local pointer.\n\nIn the success path, the arrays are released from the scheduler's\n.free_job callback, but on the error path, they are freed manually, as\nthe job was never pushed to the scheduler. While the success path deals\nwith this correctly, the fail path doesn't.\n\nOn top of that, the manual kvfree() calls only free the array storage;\nthey don't drm_syncobj_put() the per-query syncobjs that\nv3d_timestamp_query_info_free() and v3d_performance_query_info_free()\nrelease on the success path. So the same fail path that triggers the\nuse-after-free also leaks one syncobj reference per query.\n\nUnify the CPU job teardown into the CPU job's kref destructor, mirroring\nv3d_render_job_free(). The scheduler's .free_job slot reverts to the\ngeneric v3d_sched_job_free() and the fail label drops the manual\nkvfree() calls, leaving a single teardown path that is reached from both\nthe scheduler and the ioctl error path. That removes the use-after-free,\nthe NULL dereference, and the syncobj leak by construction."}],"providerMetadata":{"dateUpdated":"2026-07-19T15:40:04.925Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/acd55ea40d03e06f20a9986363019e0e5173990e"},{"url":"https://git.kernel.org/stable/c/0f8efc45740b0628a787d1b0be8a0ddabd700625"},{"url":"https://git.kernel.org/stable/c/69c2a1fec2e7ca25598180816f3bc56e1842eb41"},{"url":"https://git.kernel.org/stable/c/b0fe80c0b9250b35e2211bf3117e7aca814a21b0"}],"title":"drm/v3d: Fix use-after-free of CPU job query arrays on error path","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-64099","datePublished":"2026-07-19T15:40:04.925Z","dateReserved":"2026-07-19T07:54:57.033Z","dateUpdated":"2026-07-19T15:40:04.925Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-07-19 16:17:50","lastModifiedDate":"2026-07-19 16:17:50","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"64099","Ordinal":"1","Title":"drm/v3d: Fix use-after-free of CPU job query arrays on error pat","CVE":"CVE-2026-64099","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"64099","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Fix use-after-free of CPU job query arrays on error path\n\nThe CPU job ioctl's fail label calls kvfree() on cpu_job's timestamp and\nperformance query arrays after v3d_job_cleanup(), which drops the job's\nlast reference and frees cpu_job. Reading cpu_job at that point is a\nuse-after-free. Also, on the early v3d_job_init() failure path, it is a\nNULL dereference, since v3d_job_deallocate() zeroes the local pointer.\n\nIn the success path, the arrays are released from the scheduler's\n.free_job callback, but on the error path, they are freed manually, as\nthe job was never pushed to the scheduler. While the success path deals\nwith this correctly, the fail path doesn't.\n\nOn top of that, the manual kvfree() calls only free the array storage;\nthey don't drm_syncobj_put() the per-query syncobjs that\nv3d_timestamp_query_info_free() and v3d_performance_query_info_free()\nrelease on the success path. So the same fail path that triggers the\nuse-after-free also leaks one syncobj reference per query.\n\nUnify the CPU job teardown into the CPU job's kref destructor, mirroring\nv3d_render_job_free(). The scheduler's .free_job slot reverts to the\ngeneric v3d_sched_job_free() and the fail label drops the manual\nkvfree() calls, leaving a single teardown path that is reached from both\nthe scheduler and the ioctl error path. That removes the use-after-free,\nthe NULL dereference, and the syncobj leak by construction.","Type":"Description","Title":"drm/v3d: Fix use-after-free of CPU job query arrays on error pat"}]}}}