CVE-2026-46314 drm/v3d: Reject empty multisync extension to prevent infinite loop
A local attacker can cause a kernel infinite loop and CPU exhaustion by submitting a crafted empty multisync extension to the v3d driver.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-46314?
CVE-2026-46314 is a medium-severity denial of service vulnerability in Linux kernel, published on 8 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/v3d: Reject empty multisync extension to prevent infinite loop
v3d_get_extensions() walks a userspace-provided singly-linked list of ioctl extensions without any bound on the chain length. A local user can craft a self-referential extension (ext->next == &ext) with zero in_sync_count and out_sync_count, which bypasses the existing duplicate- extension guard:
if (se->in_sync_count || se->out_sync_count) return -EINVAL;
The guard never fires because v3d_get_multisync_post_deps() returns immediately when count is zero, leaving both fields at zero on every iteration. The result is an infinite loop in kernel context, blocking the calling thread and pegging a CPU core indefinitely.
Fix this by rejecting a multisync extension where both in_sync_count and out_sync_count are zero in v3d_get_multisync_submit_deps(). An empty multisync carries no synchronization information and serves no useful purpose, so returning -EINVAL for such an extension is the correct defense against this attack vector.
Weakness: CWE-835
Which versions are affected by CVE-2026-46314?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-46314?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-46314 being exploited?
There is no known exploitation of CVE-2026-46314 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-89639, BELL-CVE-2026-46314, DEBIAN-CVE-2026-46314, GHSA-24m2-rchh-h2mx, ROOT-OS-DEBIAN-12-CVE-2026-46314, ROOT-OS-DEBIAN-13-CVE-2026-46314 and 2 more.