Riskcovery

CVE-2026-72327

drm/v3d: Reject invalid indirect BO handle in indirect CSD setup

State
Published
Severity
Not scored
Published
Aug 15, 2026
Updated
Aug 17, 2026
Reserved
Aug 9, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/v3d: Reject invalid indirect BO handle in indirect CSD setup

v3d_get_cpu_indirect_csd_params() looks up the indirect buffer object from a userspace-supplied handle but never checks the result. A bogus or stale handle makes drm_gem_object_lookup() return NULL, which is then stored in info->indirect and only dereferenced later when the indirect CSD job runs, turning a userspace mistake into a NULL pointer dereference in the kernel.

Bail out with -ENOENT as soon as the lookup fails, so the bad handle is rejected at submission time.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 18b8413b25b7070fa2e55858a2c808e6909581d0 to before 7c27f630dc78b673e136cab7d410399a1c52146aAffected
  • 18b8413b25b7070fa2e55858a2c808e6909581d0 to before 762116dfa72865c82151970960f7cf34f44b21c8Affected
  • 18b8413b25b7070fa2e55858a2c808e6909581d0 to before 5d65dade4d84913d1879f3db6a12ac007e08314bAffected
  • 18b8413b25b7070fa2e55858a2c808e6909581d0 to before 2f8b8593c7832fad655290cef9e99af05b1b52b3Affected
LinuxLinux
  • 6.8Affected
  • before 6.8Not affected
  • 6.12.97 through 6.12.*Not affected
  • 6.18.40 through 6.18.*Not affected
  • 7.1.5 through 7.1.*Not affected
  • 7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.