CVE-2026-64099: drm/v3d: Fix use-after-free of CPU job query arrays on error path

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

drm/v3d: Fix use-after-free of CPU job query arrays on error path

The CPU job ioctl's fail label calls kvfree() on cpu_job's timestamp and
performance query arrays after v3d_job_cleanup(), which drops the job's
last reference and frees cpu_job. Reading cpu_job at that point is a
use-after-free. Also, on the early v3d_job_init() failure path, it is a
NULL dereference, since v3d_job_deallocate() zeroes the local pointer.

In the success path, the arrays are released from the scheduler's
.free_job callback, but on the error path, they are freed manually, as
the job was never pushed to the scheduler. While the success path deals
with this correctly, the fail path doesn't.

On top of that, the manual kvfree() calls only free the array storage;
they don't drm_syncobj_put() the per-query syncobjs that
v3d_timestamp_query_info_free() and v3d_performance_query_info_free()
release on the success path. So the same fail path that triggers the
use-after-free also leaks one syncobj reference per query.

Unify the CPU job teardown into the CPU job's kref destructor, mirroring
v3d_render_job_free(). The scheduler's .free_job slot reverts to the
generic v3d_sched_job_free() and the fail label drops the manual
kvfree() calls, leaving a single teardown path that is reached from both
the scheduler and the ioctl error path. That removes the use-after-free,
the NULL dereference, and the syncobj leak by construction.

The Linux kernel CVE team has assigned CVE-2026-64099 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.8 with commit 9ba0ff3e083f6a4a0b6698f06bfff74805fefa5f and fixed in 6.12.93 with commit acd55ea40d03e06f20a9986363019e0e5173990e
	Issue introduced in 6.8 with commit 9ba0ff3e083f6a4a0b6698f06bfff74805fefa5f and fixed in 6.18.34 with commit 0f8efc45740b0628a787d1b0be8a0ddabd700625
	Issue introduced in 6.8 with commit 9ba0ff3e083f6a4a0b6698f06bfff74805fefa5f and fixed in 7.0.11 with commit 69c2a1fec2e7ca25598180816f3bc56e1842eb41
	Issue introduced in 6.8 with commit 9ba0ff3e083f6a4a0b6698f06bfff74805fefa5f and fixed in 7.1 with commit b0fe80c0b9250b35e2211bf3117e7aca814a21b0

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64099
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/gpu/drm/v3d/v3d_sched.c
	drivers/gpu/drm/v3d/v3d_submit.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/acd55ea40d03e06f20a9986363019e0e5173990e
	https://git.kernel.org/stable/c/0f8efc45740b0628a787d1b0be8a0ddabd700625
	https://git.kernel.org/stable/c/69c2a1fec2e7ca25598180816f3bc56e1842eb41
	https://git.kernel.org/stable/c/b0fe80c0b9250b35e2211bf3117e7aca814a21b0