CVE-2026-68303: drm/vc4: hvs/v3d: Fix null dereference in unbind
Greg Kroah-Hartman <[email protected]>
| Newsgroups | org.kernel.vger.linux-cve-announce |
|---|---|
| Message-ID | <2026081030-CVE-2026-68303-7d13@gregkh> |
From: Greg Kroah-Hartman <[email protected]> Description =========== In the Linux kernel, the following vulnerability has been resolved: drm/vc4: hvs/v3d: Fix null dereference in unbind The hvs and v3d drivers use dev_get_drvdata(master) in their unbind functions. Since the vc4-drm gets removed before its dependent drivers (vc4_hvs/vc4_v3d) the vc4_hvs_unbind/vc4_v3d_unbind functions try to get drvdata of its master and fails with a null dereference error. Use the data pointer passed to the unbind functions directly instead of dev_get_drvdata(master). This avoids using potentially freed memory. The Linux kernel CVE team has assigned CVE-2026-68303 to this issue. Affected and fixed versions =========================== Issue introduced in 4.4 with commit c8b75bca92cbf064b9fa125fc74a85994452e935 and fixed in 7.1.6 with commit 261f0a3f0ac03248284f5116d3258f89c9642215 Issue introduced in 4.4 with commit c8b75bca92cbf064b9fa125fc74a85994452e935 and fixed in 7.2-rc5 with commit 7dc3680b7ffe01add3e9299fde8471d2dd53a8ae Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-68303 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/gpu/drm/vc4/vc4_hvs.c drivers/gpu/drm/vc4/vc4_v3d.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/261f0a3f0ac03248284f5116d3258f89c9642215 https://git.kernel.org/stable/c/7dc3680b7ffe01add3e9299fde8471d2dd53a8ae