drm/v3d: Reject invalid indirect BO handle in indirect CSD setup (Linux Linux)
En bref
- Source
- NVD
- EPSS
- EPSS 0.21 % · centile 11 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- Linux
- Statut NVD
- Received
Rechercher sur…
Description
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Reject invalid indirect BO handle in indirect CSD setup v3d_get_cpu_indirect_csd_params() looks up the indirect buffer object from a userspace-supplied handle but never checks the result. A bogus or stale handle makes drm_gem_object_lookup() return NULL, which is then stored in info->indirect and only dereferenced later when the indirect CSD job runs, turning a userspace mistake into a NULL pointer dereference in the kernel. Bail out with -ENOENT as soon as the lookup fails, so the bad handle is rejected at submission time.
Références
Références européennes
- ENISA EUVD · EUVD-2026-59226
- GCVE · GCVE-0-2026-72327
Avis du CERT-FR
- CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1333 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1286 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
Produits affectés
| Produit | Versions |
|---|---|
| Linux · Linux | affected 18b8413b25b7070fa2e55858a2c808e6909581d0 < 7c27f630dc78b673e136cab7d410399a1c52146a ; affected 18b8413b25b7070fa2e55858a2c808e6909581d0 < 762116dfa72865c82151970960f7cf34f44b21c8 ; affected 18b8413b25b7070fa2e55858a2c808e6909581d0 < 5d65dade4d84913d1879f3db6a12ac007e08314b ; affected 18b8413b25b7070fa2e55858a2c808e6909581d0 < 2f8b8593c7832fad655290cef9e99af05b1b52b3 |
| Linux · Linux | affected 6.8 ; unaffected 0 < 6.8 ; unaffected 6.12.97 ≤ 6.12.* ; unaffected 6.18.40 ≤ 6.18.* ; unaffected 7.1.5 ≤ 7.1.* ; unaffected 7.2 ≤ * |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |