CVE-2026-93192 drm/v3d: Clear queue->active_job when v3d_fence_create() fails
A use-after-free vulnerability in the Linux kernel's v3d DRM driver allows local attackers to potentially execute code or escalate privileges when fence creation fails.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-93192?
CVE-2026-93192 is a high-severity use after free vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/v3d: Clear queue->active_job when v3d_fence_create() fails
The run_job() callbacks for BIN, RENDER, TFU and CSD assign the incoming job to queue->active_job before calling v3d_fence_create(). If v3d_fence_create() fails, the callback returns NULL without clearing active_job, leaving a dangling pointer.
Create a failure path in all run_job() callbacks that clears the active job before returning NULL. The BIN path takes queue->queue_lock around the clear as it races against v3d_overflow_mem_work(); RENDER, TFU and CSD paths have no concurrent reader, so the clear is lock-free.
Which versions are affected by CVE-2026-93192?
How do I fix CVE-2026-93192?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-93192 being exploited?
There is no known exploitation of CVE-2026-93192 in the wild and no public exploit code.
Sources
Also known as AZL-102830, BELL-CVE-2026-93192, DEBIAN-CVE-2026-93192, GHSA-58h7-x7wh-hg7q, UBUNTU-CVE-2026-93192.