CVE-2026-99095— drm/vc4: drain the hangcheck timer and works on V3D unbind

Quick assessment

Affected

Linux Linux

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： drm/vc4：在 V3D 解绑（unbind）时排空挂起检查定时器及相关工作项在设备拆除过程中，没有任何机制阻止以下两项操作： 1. 已提交作业的挂起检查（hangcheck）定时器； 2. 由渲染完成中断排队的工作项。具体而言，仅取消了，而是在 DRM 管理的释放流程中调用的，此时早已执行完毕——该函数不仅卸载了 V3D 中断，还将指针置为 NULL。因此，若此时仍有定时器处于激活状态，便会尝试通过空指针访问 V3D 寄存器；同时，延迟回调函数会在

AI Predicted 5.5 Difficulty: Moderate Updated Oct 26, 2026

Possible ATT&CK Techniques 2 AI

T1069 · Permission Groups Discovery T1562

Updated Oct 26, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

drm/vc4: drain the hangcheck timer and works on V3D unbind

Source: CVE Program / CVE List V5

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: drain the hangcheck timer and works on V3D unbind Nothing stops the hangcheck timer that submitted jobs arm, or the job_done_work that the render-done interrupt queues, at teardown: vc4_irq_disable() cancels only overflow_mem_work, and vc4_gem_destroy() runs from the drm-managed release, after vc4_v3d_unbind() has already uninstalled the V3D interrupt and cleared vc4->v3d. A timer still armed by then reads V3D registers through the NULL vc4->v3d pointer, and the late callbacks run on the vc4_dev embedding them after it has been freed. Drain them in vc4_v3d_unbind(): shut the timer down and cancel reset_work before the interrupt is taken down, because its vc4_irq_reset() re-enables it, then flush job_done_work so that completions queued at teardown still release their jobs. This issue was found by an in-house static analysis tool.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Linux	Linux	d5b1a78a772f1e31a94f8babfa964152ec5e9aa5 ~ 17c5fa371de2d5508755cd4cd227cc8e2bb99240	-
Linux	Linux	4.5	-

II. Public POCs for CVE-2026-99095

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-99095

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-99095 (5)

https://www.cve.org/CVERecord?id=CVE-2026-99095

Same Patch Batch · Linux · 2026-10-26 · 12 CVEs total

CVE-2026-99099		x86/CPU/AMD: Fix AMD TLBI Erratum #1718
CVE-2026-99097		tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()
CVE-2026-99098		dm-integrity: fix buffer overflow in inline mode with large tag size
CVE-2026-99096		io_uring/register: don't exempt disabled rings from task restrictions
CVE-2026-99094		Bluetooth: btintel_pcie: fix TX descriptor bounds check
CVE-2026-99093		mm: don't schedule deferred kernel page table freeing while booting
CVE-2026-99092		riscv: patch: fix handling of bpf-jit execmem addresses
CVE-2026-99090		drm/amdgpu: serialize vblank counter reads against GPU reset
CVE-2026-99091		Bluetooth: MGMT: Fix status of pending commands flushed on power off
CVE-2026-99089		ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM
CVE-2026-99088		net: openvswitch: validate transport header presence in set_ipv6_addr

IV. Related Vulnerabilities

Same product: Linux

Same vendor: Linux