CVE-2026-98309

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98309", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.338Z", "datePublished": "2026-10-06T08:46:05.957Z", "dateUpdated": "2026-10-19T09:17:19.914Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:17:19.914Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: Use managed KMS polling to fix UAF on unbind\n\nvc4_kms_load() calls drm_kms_helper_poll_init() but the driver provides\nno matching drm_kms_helper_poll_fini(). The output poll work stays\nscheduled after unbind and runs on the freed drm_device:\n\n # modprobe vc4; rmmod vc4; sleep 10\n BUG: KASAN: slab-use-after-free in delayed_work_timer_fn\n BUG: KASAN: slab-use-after-free in drm_client_dev_hotplug [drm]\n Workqueue: events output_poll_execute [drm_kms_helper]\n Allocated by task 171: __devm_drm_dev_alloc\n Freed by task 262 (rmmod): drm_dev_put / component_del\n\nUse drmm_kms_helper_poll_init() so polling is finalized with the device,\nas other drivers do."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/vc4/vc4_kms.c"], "versions": [{"version": "c8b75bca92cbf064b9fa125fc74a85994452e935", "lessThan": "b6beee927e7f4e3142032ff91b2d0417cdddc0f6", "status": "affected", "versionType": "git"}, {"version": "c8b75bca92cbf064b9fa125fc74a85994452e935", "lessThan": "cf0c4432bda37b02e7d430ff5017228ceb7caf0c", "status": "affected", "versionType": "git"}, {"version": "c8b75bca92cbf064b9fa125fc74a85994452e935", "lessThan": "ee507691c18f9fee5d4751e295ab9a7ff31d59ae", "status": "affected", "versionType": "git"}, {"version": "c8b75bca92cbf064b9fa125fc74a85994452e935", "lessThan": "7f9780df677370a19b4ec9764f13b1b82073e0d9", "status": "affected", "versionType": "git"}, {"version": "c8b75bca92cbf064b9fa125fc74a85994452e935", "lessThan": "073a30d75f309812ed61af134f24ffef4107b13a", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/vc4/vc4_kms.c"], "versions": [{"version": "4.4", "status": "affected"}, {"version": "0", "lessThan": "4.4", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.54", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.8", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.18.54"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "7.2.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b6beee927e7f4e3142032ff91b2d0417cdddc0f6"}, {"url": "https://git.kernel.org/stable/c/cf0c4432bda37b02e7d430ff5017228ceb7caf0c"}, {"url": "https://git.kernel.org/stable/c/ee507691c18f9fee5d4751e295ab9a7ff31d59ae"}, {"url": "https://git.kernel.org/stable/c/7f9780df677370a19b4ec9764f13b1b82073e0d9"}, {"url": "https://git.kernel.org/stable/c/073a30d75f309812ed61af134f24ffef4107b13a"}], "title": "drm/vc4: Use managed KMS polling to fix UAF on unbind", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/vc4/vc4_kms.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b6beee927e7f4e3142032ff91b2d0417cdddc0f6", "status": "affected", "version": "c8b75bca92cbf064b9fa125fc74a85994452e935", "versionType": "git"}, {"lessThan": "cf0c4432bda37b02e7d430ff5017228ceb7caf0c", "status": "affected", "version": "c8b75bca92cbf064b9fa125fc74a85994452e935", "versionType": "git"}, {"lessThan": "ee507691c18f9fee5d4751e295ab9a7ff31d59ae", "status": "affected", "version": "c8b75bca92cbf064b9fa125fc74a85994452e935", "versionType": "git"}, {"lessThan": "7f9780df677370a19b4ec9764f13b1b82073e0d9", "status": "affected", "version": "c8b75bca92cbf064b9fa125fc74a85994452e935", "versionType": "git"}, {"lessThan": "073a30d75f309812ed61af134f24ffef4107b13a", "status": "affected", "version": "c8b75bca92cbf064b9fa125fc74a85994452e935", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/vc4/vc4_kms.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.4"}, {"lessThan": "4.4", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.54", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: Use managed KMS polling to fix UAF on unbind\n\nvc4_kms_load() calls drm_kms_helper_poll_init() but the driver provides\nno matching drm_kms_helper_poll_fini(). The output poll work stays\nscheduled after unbind and runs on the freed drm_device:\n\n # modprobe vc4; rmmod vc4; sleep 10\n BUG: KASAN: slab-use-after-free in delayed_work_timer_fn\n BUG: KASAN: slab-use-after-free in drm_client_dev_hotplug [drm]\n Workqueue: events output_poll_execute [drm_kms_helper]\n Allocated by task 171: __devm_drm_dev_alloc\n Freed by task 262 (rmmod): drm_dev_put / component_del\n\nUse drmm_kms_helper_poll_init() so polling is finalized with the device,\nas other drivers do."}], "id": "CVE-2026-98309", "lastModified": "2026-10-19T10:18:32.947", "metrics": {}, "published": "2026-10-06T09:18:22.300", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/073a30d75f309812ed61af134f24ffef4107b13a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7f9780df677370a19b4ec9764f13b1b82073e0d9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b6beee927e7f4e3142032ff91b2d0417cdddc0f6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cf0c4432bda37b02e7d430ff5017228ceb7caf0c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ee507691c18f9fee5d4751e295ab9a7ff31d59ae"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: drm/vc4: Use managed KMS polling to fix UAF on unbind", "id": "2546345", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546345"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/vc4: Use managed KMS polling to fix UAF on unbind\nvc4_kms_load() calls drm_kms_helper_poll_init() but the driver provides\nno matching drm_kms_helper_poll_fini(). The output poll work stays\nscheduled after unbind and runs on the freed drm_device:\n# modprobe vc4; rmmod vc4; sleep 10\nBUG: KASAN: slab-use-after-free in delayed_work_timer_fn\nBUG: KASAN: slab-use-after-free in drm_client_dev_hotplug [drm]\nWorkqueue: events output_poll_execute [drm_kms_helper]\nAllocated by task 171: __devm_drm_dev_alloc\nFreed by task 262 (rmmod): drm_dev_put / component_del\nUse drmm_kms_helper_poll_init() so polling is finalized with the device,\nas other drivers do.", "A flaw was found in the Linux kernel. A use-after-free vulnerability exists in the VideoCore IV (vc4) display driver where background polling tasks are not properly finalized when the driver is unbound. A local user could exploit this flaw by unbinding the device or unloading the driver module, causing background routines to access memory after it has been freed. This issue can lead to a system crash, resulting in a Denial of Service (DoS), or potentially allow arbitrary code execution."], "name": "CVE-2026-98309", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98309\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98309\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98309.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c8b75bca92cbf064b9fa125fc74a85994452e935,b6beee927e7f4e3142032ff91b2d0417cdddc0f6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c8b75bca92cbf064b9fa125fc74a85994452e935,cf0c4432bda37b02e7d430ff5017228ceb7caf0c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c8b75bca92cbf064b9fa125fc74a85994452e935,ee507691c18f9fee5d4751e295ab9a7ff31d59ae)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c8b75bca92cbf064b9fa125fc74a85994452e935,7f9780df677370a19b4ec9764f13b1b82073e0d9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c8b75bca92cbf064b9fa125fc74a85994452e935,073a30d75f309812ed61af134f24ffef4107b13a)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.4"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.4)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.158,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.54,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.8,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc4,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-06T13:15:16.590570+00:00", "updated": "2026-10-11T17:30:17.842608+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}