CVE-2026-68233 drm/vc4: Shut down BO cache timer before teardown
A race condition in the Linux kernel's VC4 DRM driver allows a local attacker to cause a denial of service by triggering a use-after-free during teardown.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-68233?
CVE-2026-68233 is a vulnerability in Linux, published on 10 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/vc4: Shut down BO cache timer before teardown
The BO cache timer callback schedules time_work, and time_work can rearm the timer through vc4_bo_cache_free_old().
vc4_bo_cache_destroy() deletes the timer and then cancels the work, which does not break that cycle: the work being cancelled can rearm the timer, and the timer then queues work again after teardown.
Use timer_shutdown_sync() instead, so the timer cannot be rearmed and the cycle ends with cancel_work_sync().
Which versions are affected by CVE-2026-68233?
How do I fix CVE-2026-68233?
Apply the vendor's patch.
Is CVE-2026-68233 being exploited?
There is no known exploitation of CVE-2026-68233 in the wild and no public exploit code.
Sources
Also known as AZL-95135, BELL-CVE-2026-68233, DEBIAN-CVE-2026-68233, GHSA-q3jj-fvxw-r3cf, UBUNTU-CVE-2026-68233.