drm/v3d: Reject invalid indirect BO handle in indirect CSD setup (Linux Linux)

CVE-2026-72327
Non disponible

En bref

Source
NVD
EPSS
EPSS 0.21 % · centile 11 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
Linux
Statut NVD
Received

Description

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Reject invalid indirect BO handle in indirect CSD setup v3d_get_cpu_indirect_csd_params() looks up the indirect buffer object from a userspace-supplied handle but never checks the result. A bogus or stale handle makes drm_gem_object_lookup() return NULL, which is then stored in info->indirect and only dereferenced later when the indirect CSD job runs, turning a userspace mistake into a NULL pointer dereference in the kernel. Bail out with -ENOENT as soon as the lookup fails, so the bad handle is rejected at submission time.

Références

Références européennes

Avis du CERT-FR

Produits affectés

ProduitVersions
Linux · Linuxaffected 18b8413b25b7070fa2e55858a2c808e6909581d0 < 7c27f630dc78b673e136cab7d410399a1c52146a ; affected 18b8413b25b7070fa2e55858a2c808e6909581d0 < 762116dfa72865c82151970960f7cf34f44b21c8 ; affected 18b8413b25b7070fa2e55858a2c808e6909581d0 < 5d65dade4d84913d1879f3db6a12ac007e08314b ; affected 18b8413b25b7070fa2e55858a2c808e6909581d0 < 2f8b8593c7832fad655290cef9e99af05b1b52b3
Linux · Linuxaffected 6.8 ; unaffected 0 < 6.8 ; unaffected 6.12.97 ≤ 6.12.* ; unaffected 6.18.40 ≤ 6.18.* ; unaffected 7.1.5 ≤ 7.1.* ; unaffected 7.2 ≤ *

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD