CVE-2026-68233drm/vc4: Shut down BO cache timer before teardown
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Shut down BO cache timer before teardown The BO cache timer callback schedules time_work, and time_work can rearm the timer through vc4_bo_cache_free_old(). vc4_bo_cache_destroy() deletes the timer and then cancels the work, which does not break that cycle: the work being cancelled can rearm the timer, and the timer then queues work again after teardown. Use timer_shutdown_sync() instead, so the timer cannot be rearmed and the cycle ends with cancel_work_sync().
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from c826a6e1064419f78855463cf29ce9e8b9d25bf4 before a38f2724eb93a78ba250b01e0caf3468df4d3956; from c826a6e1064419f78855463cf29ce9e8b9d25bf4 before bac4c1a9af690b8635c6924872075c41d8763ed9; from c826a6e1064419f78855463cf29ce9e8b9d25bf4 before 6273dd3ffb54ec581855b82ae77331b66028249c | CNA record |
References
- https://git.kernel.org/stable/c/a38f2724eb93a78ba250b01e0caf3468df4d3956
- https://git.kernel.org/stable/c/bac4c1a9af690b8635c6924872075c41d8763ed9
- https://git.kernel.org/stable/c/6273dd3ffb54ec581855b82ae77331b66028249c
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.