Linux Kernel Vulnerability Affecting VC4 and V3D Products by Linux Foundation

CVE-2026-99095

What is CVE-2026-99095?

A critical programming error exists in the Linux kernel related to the VC4 and V3D components. During the tear down process, the hangcheck timer continues to operate even after the necessary resources have been freed, leading to potential null pointer dereference vulnerabilities. This results from inadequate management of job completion and interrupt handling when the V3D driver is unbound. The flaw can allow late callbacks to execute on freed resources, risking instability and exposure to unauthorized operations. Proper mitigation involves shutting down the hangcheck timer and ensuring all job completions are flushed prior to disabling interrupts, preserving system integrity and security.

References