CVE-2026-64099

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Fix use-after-free of CPU job query arrays on error path The CPU job ioctl's fail label calls kvfree() on cpu_job's timestamp and performance query arrays after v3d_job_cleanup(), which drops the job's last reference and frees cpu_job. Reading cpu_job at that point is a use-after-free. Also, on the early v3d_job_init() failure path, it is a NULL dereference, since v3d_job_deallocate() zeroes the local pointer. In the success path, the arrays are released from the scheduler's .free_job callback, but on the error path, they are freed manually, as the job was never pushed to the scheduler. While the success path deals with this correctly, the fail path doesn't. On top of that, the manual kvfree() calls only free the array storage; they don't drm_syncobj_put() the per-query syncobjs that v3d_timestamp_query_info_free() and v3d_performance_query_info_free() release on the success path. So the same fail path that triggers the use-after-free also leaks one syncobj reference per query. Unify the CPU job teardown into the CPU job's kref destructor, mirroring v3d_render_job_free(). The scheduler's .free_job slot reverts to the generic v3d_sched_job_free() and the fail label drops the manual kvfree() calls, leaving a single teardown path that is reached from both the scheduler and the ioctl error path. That removes the use-after-free, the NULL dereference, and the syncobj leak by construction.

• CWE-416

• https://git.kernel.org/stable/c/0f8efc45740b0628a787d1b0be8a0ddabd700625Patch
• https://git.kernel.org/stable/c/69c2a1fec2e7ca25598180816f3bc56e1842eb41Patch
• https://git.kernel.org/stable/c/acd55ea40d03e06f20a9986363019e0e5173990ePatch
• https://git.kernel.org/stable/c/b0fe80c0b9250b35e2211bf3117e7aca814a21b0Patch

Published

Jul 19, 2026

Last Modified

Aug 11, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-64093In the Linux kernel, the following vulnerability has been re…8.8
• CVE-2026-64094In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-64095In the Linux kernel, the following vulnerability has been re…7.1
• CVE-2026-64096In the Linux kernel, the following vulnerability has been re…8.8
• CVE-2026-64097In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-64098In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-6410@fastify/static versions 8.0.0 through 9.1.0 allow path trav…5.3
• CVE-2026-64100In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-64101In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-64102In the Linux kernel, the following vulnerability has been re…9.8
• CVE-2026-64103In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-64104In the Linux kernel, the following vulnerability has been re…8.7