CVE-2026-72327drm/v3d: Reject invalid indirect BO handle in indirect CSD setup
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Reject invalid indirect BO handle in indirect CSD setup v3d_get_cpu_indirect_csd_params() looks up the indirect buffer object from a userspace-supplied handle but never checks the result. A bogus or stale handle makes drm_gem_object_lookup() return NULL, which is then stored in info->indirect and only dereferenced later when the indirect CSD job runs, turning a userspace mistake into a NULL pointer dereference in the kernel. Bail out with -ENOENT as soon as the lookup fails, so the bad handle is rejected at submission time.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 18b8413b25b7070fa2e55858a2c808e6909581d0 builds before 7c27f630dc78b673e136cab7d410399a1c52146a; from 18b8413b25b7070fa2e55858a2c808e6909581d0 before 762116dfa72865c82151970960f7cf34f44b21c8; 18b8413b25b7070fa2e55858a2c808e6909581d0 builds before 5d65dade4d84913d1879f3db6a12ac007e08314b; 18b8413b25b7070fa2e55858a2c808e6909581d0 builds before 2f8b8593c7832fad655290cef9e99af05b1b52b3 | CNA record |
References
- https://git.kernel.org/stable/c/7c27f630dc78b673e136cab7d410399a1c52146a
- https://git.kernel.org/stable/c/762116dfa72865c82151970960f7cf34f44b21c8
- https://git.kernel.org/stable/c/5d65dade4d84913d1879f3db6a12ac007e08314b
- https://git.kernel.org/stable/c/2f8b8593c7832fad655290cef9e99af05b1b52b3
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.