CVE-2026-46314

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Reject empty multisync extension to prevent infinite loop v3d_get_extensions() walks a userspace-provided singly-linked list of ioctl extensions without any bound on the chain length. A local user can craft a self-referential extension (ext->next == &ext) with zero in_sync_count and out_sync_count, which bypasses the existing duplicate- extension guard: if (se->in_sync_count || se->out_sync_count) return -EINVAL; The guard never fires because v3d_get_multisync_post_deps() returns immediately when count is zero, leaving both fields at zero on every iteration. The result is an infinite loop in kernel context, blocking the calling thread and pegging a CPU core indefinitely. Fix this by rejecting a multisync extension where both in_sync_count and out_sync_count are zero in v3d_get_multisync_submit_deps(). An empty multisync carries no synchronization information and serves no useful purpose, so returning -EINVAL for such an extension is the correct defense against this attack vector.

• CWE-835

• https://git.kernel.org/stable/c/309abbddeca0c12714721928a819ef45e5710998Patch
• https://git.kernel.org/stable/c/4fa42a249e8cd6ed17aea04e5695b6e9001f2433Patch
• https://git.kernel.org/stable/c/9c5164781cb388d219d8f49fa0f0b04cf86ad544Patch
• https://git.kernel.org/stable/c/fb44d589bf3148e13452185a6e772a7efbf2d684Patch

Published

Jun 8, 2026

Last Modified

Jul 23, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-46309In the Linux kernel, the following vulnerability has been re…7
• CVE-2026-4631Cockpit's remote login feature passes user-supplied hostname…9.8
• CVE-2026-46310In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-46311In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-46312In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-46313In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-46315In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-46316In the Linux kernel, the following vulnerability has been re…9.3
• CVE-2026-46317In the Linux kernel, the following vulnerability has been re…8.8
• CVE-2026-46318In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-46319In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-4632A weakness has been identified in itsourcecode Online Enroll…7.3