---
id: CVE-2026-93192
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/v3d: Clear queue->active_job when v3d_fence_create() fails

  The run_job() callbacks for BIN, RENDER, TFU and CSD assign the incoming
  job to queue->active_job before…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/v3d: Clear queue->active_job when v3d_fence_create() fails

  The run_job() callbacks for BIN, RENDER, TFU and CSD assign the incoming
  job to queue->active_job before…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= a783a09ee76d6259296dc6aeea2b6884fa526980 <
    bdeb73d7312100e00c3e643ff233f09b6ec114aa
  - >-
    Linux >= a783a09ee76d6259296dc6aeea2b6884fa526980 <
    3a8aa74859dd73eaa76c55eb74da708e56ef51c5
  - >-
    Linux >= a783a09ee76d6259296dc6aeea2b6884fa526980 <
    0b9878aba5cf93bc2b55ba9eb807757ce3239bec
  - >-
    Linux >= a783a09ee76d6259296dc6aeea2b6884fa526980 <
    25a1669907512e927fab9ad4d4fb74ff57f63cd9
  - Linux 5.3
published: '2026-09-17'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T18:18:24.610'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93192'
references:
  - url: 'https://git.kernel.org/stable/c/0b9878aba5cf93bc2b55ba9eb807757ce3239bec'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/25a1669907512e927fab9ad4d4fb74ff57f63cd9'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3a8aa74859dd73eaa76c55eb74da708e56ef51c5'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/bdeb73d7312100e00c3e643ff233f09b6ec114aa'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00175
epssPercentile: 0.06167
ingestedAt: '2026-09-17T16:21:47.724Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/v3d: Clear queue->active_job when v3d_fence_create() fails

The run_job() callbacks for BIN, RENDER, TFU and CSD assign the incoming
job to queue->active_job before calling v3d_fence_create(). If
v3d_fence_create() fails, the callback returns NULL without clearing
active_job, leaving a dangling pointer.

Create a failure path in all run_job() callbacks that clears the active
job before returning NULL. The BIN path takes queue->queue_lock around the
clear as it races against v3d_overflow_mem_work(); RENDER, TFU and CSD
paths have no concurrent reader, so the clear is lock-free.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.