-

CVE-2026-98309

drm/vc4: Use managed KMS polling to fix UAF on unbind

In the Linux kernel, the following vulnerability has been resolved:

drm/vc4: Use managed KMS polling to fix UAF on unbind

vc4_kms_load() calls drm_kms_helper_poll_init() but the driver provides
no matching drm_kms_helper_poll_fini(). The output poll work stays
scheduled after unbind and runs on the freed drm_device:

  # modprobe vc4; rmmod vc4; sleep 10
  BUG: KASAN: slab-use-after-free in delayed_work_timer_fn
  BUG: KASAN: slab-use-after-free in drm_client_dev_hotplug [drm]
  Workqueue: events output_poll_execute [drm_kms_helper]
  Allocated by task 171: __devm_drm_dev_alloc
  Freed by task 262 (rmmod): drm_dev_put / component_del

Use drmm_kms_helper_poll_init() so polling is finalized with the device,
as other drivers do.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version c8b75bca92cbf064b9fa125fc74a85994452e935
Version < b6beee927e7f4e3142032ff91b2d0417cdddc0f6
Status affected
Version c8b75bca92cbf064b9fa125fc74a85994452e935
Version < cf0c4432bda37b02e7d430ff5017228ceb7caf0c
Status affected
Version c8b75bca92cbf064b9fa125fc74a85994452e935
Version < ee507691c18f9fee5d4751e295ab9a7ff31d59ae
Status affected
Version c8b75bca92cbf064b9fa125fc74a85994452e935
Version < 7f9780df677370a19b4ec9764f13b1b82073e0d9
Status affected
Version c8b75bca92cbf064b9fa125fc74a85994452e935
Version < 073a30d75f309812ed61af134f24ffef4107b13a
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 4.4
Status affected
Version 0
Version < 4.4
Status unaffected
Version <= 6.6.*
Version 6.6.158
Status unaffected
Version <= 6.12.*
Version 6.12.112
Status unaffected
Version <= 6.18.*
Version 6.18.54
Status unaffected
Version <= 7.2.*
Version 7.2.8
Status unaffected
Version <= *
Version 7.3-rc4
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.18% 0.064
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/b6beee927e7f4e3142032ff91b2d0417cdddc0f6
https://git.kernel.org/stable/c/cf0c4432bda37b02e7d430ff5017228ceb7caf0c
https://git.kernel.org/stable/c/ee507691c18f9fee5d4751e295ab9a7ff31d59ae
https://git.kernel.org/stable/c/7f9780df677370a19b4ec9764f13b1b82073e0d9
https://git.kernel.org/stable/c/073a30d75f309812ed61af134f24ffef4107b13a