{"id":"CVE-2026-99095","title":"drm/vc4: drain the hangcheck timer and works on V3D unbind","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: drain the hangcheck timer and works on V3D unbind\n\nNothing stops the hangcheck timer that submitted jobs arm, or the\njob_done_work that the render-done interru…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= d5b1a78a772f1e31a94f8babfa964152ec5e9aa5 < 17c5fa371de2d5508755cd4cd227cc8e2bb99240","Linux >= d5b1a78a772f1e31a94f8babfa964152ec5e9aa5 < a046cd60ff3f4a8c8e672b3b18902682c1f91731","Linux >= d5b1a78a772f1e31a94f8babfa964152ec5e9aa5 < e61465d3e0292daebf4dbb34e0add635e2439569","Linux >= d5b1a78a772f1e31a94f8babfa964152ec5e9aa5 < ade226dfd28cf2fd1dce143c556d1ee77d953696","Linux >= d5b1a78a772f1e31a94f8babfa964152ec5e9aa5 < 94cf5971b1d04c6382437387c4dc3836cc7a1437","Linux 4.5"],"published":"2026-10-26","updated":"2026-10-26","sourceUpdated":"2026-10-26T14:52:02.647Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-99095","references":[{"url":"https://git.kernel.org/stable/c/17c5fa371de2d5508755cd4cd227cc8e2bb99240"},{"url":"https://git.kernel.org/stable/c/a046cd60ff3f4a8c8e672b3b18902682c1f91731"},{"url":"https://git.kernel.org/stable/c/e61465d3e0292daebf4dbb34e0add635e2439569"},{"url":"https://git.kernel.org/stable/c/ade226dfd28cf2fd1dce143c556d1ee77d953696"},{"url":"https://git.kernel.org/stable/c/94cf5971b1d04c6382437387c4dc3836cc7a1437"}],"tags":["cve.org"],"ingestedAt":"2026-10-26T15:29:30.506Z","slug":"CVE-2026-99095","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: drain the hangcheck timer and works on V3D unbind\n\nNothing stops the hangcheck timer that submitted jobs arm, or the\njob_done_work that the render-done interrupt queues, at teardown:\nvc4_irq_disable() cancels only overflow_mem_work, and vc4_gem_destroy()\nruns from the drm-managed release, after vc4_v3d_unbind() has already\nuninstalled the V3D interrupt and cleared vc4->v3d. A timer still armed\nby then reads V3D registers through the NULL vc4->v3d pointer, and the\nlate callbacks run on the vc4_dev embedding them after it has been\nfreed.\n\nDrain them in vc4_v3d_unbind(): shut the timer down and cancel\nreset_work before the interrupt is taken down, because its\nvc4_irq_reset() re-enables it, then flush job_done_work so that\ncompletions queued at teardown still release their jobs.\n\nThis issue was found by an in-house static analysis tool.\n\n## Affected\n\n- `Linux >= d5b1a78a772f1e31a94f8babfa964152ec5e9aa5 < 17c5fa371de2d5508755cd4cd227cc8e2bb99240`\n- `Linux >= d5b1a78a772f1e31a94f8babfa964152ec5e9aa5 < a046cd60ff3f4a8c8e672b3b18902682c1f91731`\n- `Linux >= d5b1a78a772f1e31a94f8babfa964152ec5e9aa5 < e61465d3e0292daebf4dbb34e0add635e2439569`\n- `Linux >= d5b1a78a772f1e31a94f8babfa964152ec5e9aa5 < ade226dfd28cf2fd1dce143c556d1ee77d953696`\n- `Linux >= d5b1a78a772f1e31a94f8babfa964152ec5e9aa5 < 94cf5971b1d04c6382437387c4dc3836cc7a1437`\n- `Linux 4.5`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}