CVE-2026-64099

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64099", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.033Z", "datePublished": "2026-07-19T15:40:04.925Z", "dateUpdated": "2026-08-05T12:39:13.645Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:39:13.645Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Fix use-after-free of CPU job query arrays on error path\n\nThe CPU job ioctl's fail label calls kvfree() on cpu_job's timestamp and\nperformance query arrays after v3d_job_cleanup(), which drops the job's\nlast reference and frees cpu_job. Reading cpu_job at that point is a\nuse-after-free. Also, on the early v3d_job_init() failure path, it is a\nNULL dereference, since v3d_job_deallocate() zeroes the local pointer.\n\nIn the success path, the arrays are released from the scheduler's\n.free_job callback, but on the error path, they are freed manually, as\nthe job was never pushed to the scheduler. While the success path deals\nwith this correctly, the fail path doesn't.\n\nOn top of that, the manual kvfree() calls only free the array storage;\nthey don't drm_syncobj_put() the per-query syncobjs that\nv3d_timestamp_query_info_free() and v3d_performance_query_info_free()\nrelease on the success path. So the same fail path that triggers the\nuse-after-free also leaks one syncobj reference per query.\n\nUnify the CPU job teardown into the CPU job's kref destructor, mirroring\nv3d_render_job_free(). The scheduler's .free_job slot reverts to the\ngeneric v3d_sched_job_free() and the fail label drops the manual\nkvfree() calls, leaving a single teardown path that is reached from both\nthe scheduler and the ioctl error path. That removes the use-after-free,\nthe NULL dereference, and the syncobj leak by construction."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reachable only through the DRM_IOCTL_V3D_SUBMIT_CPU ioctl on /dev/dri/renderD*, requiring local access to the GPU render node; there is no network, adjacent-radio, or physical-device attack path to this code.\nAC:L - An attacker can deterministically trigger the vulnerable error path by submitting a crafted CPU job with timestamp/performance-query extensions and then forcing a controlled failure (e.g., invalid BO handle after v3d_job_init(), or a multisync init failure), without depending on races or external timing.\nPR:L - The ioctl is permitted on render nodes (DRM_RENDER_ALLOW | DRM_AUTH), which unprivileged local users on affected Broadcom V3D systems (e.g., Raspberry Pi users in the render/video group, GPU containers with /dev/dri passthrough) can open without real root in the init namespace.\nUI:N - Exploitation requires only the attacker's own ioctl submissions to the render node; no separate victim user action (opening files, mounting filesystems, clicking links) is needed beyond the attacker already having local GPU client access.\nS:U - Successful exploitation yields standard host-kernel memory corruption and privilege escalation within the same kernel security authority; it does not inherently cross a hypervisor/IOMMU boundary or constitute a VM escape on its own.\nC:H - The fail path performs a use-after-free read of freed cpu_job metadata to reach timestamp/performance query arrays, which per kernel UAF guidance enables arbitrary kernel memory disclosure via heap grooming and corrupted object interpretation.\nI:H - The same use-after-free on kernel heap objects can be leveraged for arbitrary kernel writes and control-flow hijacking through heap spraying and reuse of the freed cpu_job/query structures, not merely a bounded or cosmetic corruption.\nA:H - The vulnerable error path also NULL-dereferences cpu_job when v3d_job_init() fails after v3d_job_deallocate(), and the use-after-free itself can provoke kernel oops/panic, giving reliable high availability impact."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/v3d/v3d_sched.c", "drivers/gpu/drm/v3d/v3d_submit.c"], "versions": [{"version": "9ba0ff3e083f6a4a0b6698f06bfff74805fefa5f", "lessThan": "acd55ea40d03e06f20a9986363019e0e5173990e", "status": "affected", "versionType": "git"}, {"version": "9ba0ff3e083f6a4a0b6698f06bfff74805fefa5f", "lessThan": "0f8efc45740b0628a787d1b0be8a0ddabd700625", "status": "affected", "versionType": "git"}, {"version": "9ba0ff3e083f6a4a0b6698f06bfff74805fefa5f", "lessThan": "69c2a1fec2e7ca25598180816f3bc56e1842eb41", "status": "affected", "versionType": "git"}, {"version": "9ba0ff3e083f6a4a0b6698f06bfff74805fefa5f", "lessThan": "b0fe80c0b9250b35e2211bf3117e7aca814a21b0", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/v3d/v3d_sched.c", "drivers/gpu/drm/v3d/v3d_submit.c"], "versions": [{"version": "6.8", "status": "affected"}, {"version": "0", "lessThan": "6.8", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.93", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.34", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.11", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.12.93"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.18.34"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "7.0.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/acd55ea40d03e06f20a9986363019e0e5173990e"}, {"url": "https://git.kernel.org/stable/c/0f8efc45740b0628a787d1b0be8a0ddabd700625"}, {"url": "https://git.kernel.org/stable/c/69c2a1fec2e7ca25598180816f3bc56e1842eb41"}, {"url": "https://git.kernel.org/stable/c/b0fe80c0b9250b35e2211bf3117e7aca814a21b0"}], "title": "drm/v3d: Fix use-after-free of CPU job query arrays on error path", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/v3d/v3d_sched.c", "drivers/gpu/drm/v3d/v3d_submit.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "acd55ea40d03e06f20a9986363019e0e5173990e", "status": "affected", "version": "9ba0ff3e083f6a4a0b6698f06bfff74805fefa5f", "versionType": "git"}, {"lessThan": "0f8efc45740b0628a787d1b0be8a0ddabd700625", "status": "affected", "version": "9ba0ff3e083f6a4a0b6698f06bfff74805fefa5f", "versionType": "git"}, {"lessThan": "69c2a1fec2e7ca25598180816f3bc56e1842eb41", "status": "affected", "version": "9ba0ff3e083f6a4a0b6698f06bfff74805fefa5f", "versionType": "git"}, {"lessThan": "b0fe80c0b9250b35e2211bf3117e7aca814a21b0", "status": "affected", "version": "9ba0ff3e083f6a4a0b6698f06bfff74805fefa5f", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/v3d/v3d_sched.c", "drivers/gpu/drm/v3d/v3d_submit.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.8"}, {"lessThan": "6.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.93", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.34", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "36E2BF0A-A474-4036-A49D-CE2668F062D4", "versionEndExcluding": "6.12.93", "versionStartIncluding": "6.8", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A4B1EF6D-18D7-4838-BC37-7499D5DCC3C0", "versionEndExcluding": "6.18.34", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0520D091-FC52-4A50-AF07-70AE7D08B750", "versionEndExcluding": "7.0.11", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*", "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Fix use-after-free of CPU job query arrays on error path\n\nThe CPU job ioctl's fail label calls kvfree() on cpu_job's timestamp and\nperformance query arrays after v3d_job_cleanup(), which drops the job's\nlast reference and frees cpu_job. Reading cpu_job at that point is a\nuse-after-free. Also, on the early v3d_job_init() failure path, it is a\nNULL dereference, since v3d_job_deallocate() zeroes the local pointer.\n\nIn the success path, the arrays are released from the scheduler's\n.free_job callback, but on the error path, they are freed manually, as\nthe job was never pushed to the scheduler. While the success path deals\nwith this correctly, the fail path doesn't.\n\nOn top of that, the manual kvfree() calls only free the array storage;\nthey don't drm_syncobj_put() the per-query syncobjs that\nv3d_timestamp_query_info_free() and v3d_performance_query_info_free()\nrelease on the success path. So the same fail path that triggers the\nuse-after-free also leaks one syncobj reference per query.\n\nUnify the CPU job teardown into the CPU job's kref destructor, mirroring\nv3d_render_job_free(). The scheduler's .free_job slot reverts to the\ngeneric v3d_sched_job_free() and the fail label drops the manual\nkvfree() calls, leaving a single teardown path that is reached from both\nthe scheduler and the ioctl error path. That removes the use-after-free,\nthe NULL dereference, and the syncobj leak by construction."}], "id": "CVE-2026-64099", "lastModified": "2026-08-11T16:05:40.573", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-07-19T16:17:50.983", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0f8efc45740b0628a787d1b0be8a0ddabd700625"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/69c2a1fec2e7ca25598180816f3bc56e1842eb41"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/acd55ea40d03e06f20a9986363019e0e5173990e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b0fe80c0b9250b35e2211bf3117e7aca814a21b0"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: drm/v3d: Fix use-after-free of CPU job query arrays on error path", "id": "2502538", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502538"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/v3d: Fix use-after-free of CPU job query arrays on error path\nThe CPU job ioctl's fail label calls kvfree() on cpu_job's timestamp and\nperformance query arrays after v3d_job_cleanup(), which drops the job's\nlast reference and frees cpu_job. Reading cpu_job at that point is a\nuse-after-free. Also, on the early v3d_job_init() failure path, it is a\nNULL dereference, since v3d_job_deallocate() zeroes the local pointer.\nIn the success path, the arrays are released from the scheduler's\n.free_job callback, but on the error path, they are freed manually, as\nthe job was never pushed to the scheduler. While the success path deals\nwith this correctly, the fail path doesn't.\nOn top of that, the manual kvfree() calls only free the array storage;\nthey don't drm_syncobj_put() the per-query syncobjs that\nv3d_timestamp_query_info_free() and v3d_performance_query_info_free()\nrelease on the success path. So the same fail path that triggers the\nuse-after-free also leaks one syncobj reference per query.\nUnify the CPU job teardown into the CPU job's kref destructor, mirroring\nv3d_render_job_free(). The scheduler's .free_job slot reverts to the\ngeneric v3d_sched_job_free() and the fail label drops the manual\nkvfree() calls, leaving a single teardown path that is reached from both\nthe scheduler and the ioctl error path. That removes the use-after-free,\nthe NULL dereference, and the syncobj leak by construction.", "A flaw was found in the Linux kernel's drm/v3d graphics driver. This vulnerability, a use-after-free error, occurs in the CPU job input/output control (ioctl) error path. When an error is encountered, the system attempts to access memory that has already been freed, which can lead to system instability, a denial of service, or potentially allow a local attacker to execute arbitrary code."], "name": "CVE-2026-64099", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "impact": "important", "package_name": "erlang27", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-64099\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64099\nhttps://lore.kernel.org/linux-cve-announce/2026071919-CVE-2026-64099-f51b@gregkh/T"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9ba0ff3e083f6a4a0b6698f06bfff74805fefa5f,acd55ea40d03e06f20a9986363019e0e5173990e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9ba0ff3e083f6a4a0b6698f06bfff74805fefa5f,0f8efc45740b0628a787d1b0be8a0ddabd700625)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9ba0ff3e083f6a4a0b6698f06bfff74805fefa5f,69c2a1fec2e7ca25598180816f3bc56e1842eb41)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9ba0ff3e083f6a4a0b6698f06bfff74805fefa5f,b0fe80c0b9250b35e2211bf3117e7aca814a21b0)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.8"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.8)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.93,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.34,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.11,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-21T09:45:03.989923+00:00", "updated": "2026-08-13T12:00:05.178182+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}