CVE-2026-99095 drm/vc4: drain the hangcheck timer and works on V3D unbind
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-99095?
CVE-2026-99095 is a vulnerability in Linux, published on 26 Oct 2026.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/vc4: drain the hangcheck timer and works on V3D unbind
Nothing stops the hangcheck timer that submitted jobs arm, or the job_done_work that the render-done interrupt queues, at teardown: vc4_irq_disable() cancels only overflow_mem_work, and vc4_gem_destroy() runs from the drm-managed release, after vc4_v3d_unbind() has already uninstalled the V3D interrupt and cleared vc4->v3d. A timer still armed by then reads V3D registers through the NULL vc4->v3d pointer, and the late callbacks run on the vc4_dev embedding them after it has been freed.
Drain them in vc4_v3d_unbind(): shut the timer down and cancel reset_work before the interrupt is taken down, because its vc4_irq_reset() re-enables it, then flush job_done_work so that completions queued at teardown still release their jobs.
This issue was found by an in-house static analysis tool.
Which versions are affected by CVE-2026-99095?
How do I fix CVE-2026-99095?
Upgrade to a fixed version.
Is CVE-2026-99095 being exploited?
There is no known exploitation of CVE-2026-99095 in the wild and no public exploit code.
Sources
Also known as AZL-111128, BELL-CVE-2026-99095, DEBIAN-CVE-2026-99095, GHSA-v4rc-4368-fvrr, UBUNTU-CVE-2026-99095.