CVE-2026-46314 (GCVE-0-2026-46314)

Vulnerability from cvelistv5 – Published: 2026-06-08 15:50 – Updated: 2026-06-19 12:00
VLAI
Title
drm/v3d: Reject empty multisync extension to prevent infinite loop
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Reject empty multisync extension to prevent infinite loop v3d_get_extensions() walks a userspace-provided singly-linked list of ioctl extensions without any bound on the chain length. A local user can craft a self-referential extension (ext->next == &ext) with zero in_sync_count and out_sync_count, which bypasses the existing duplicate- extension guard: if (se->in_sync_count || se->out_sync_count) return -EINVAL; The guard never fires because v3d_get_multisync_post_deps() returns immediately when count is zero, leaving both fields at zero on every iteration. The result is an infinite loop in kernel context, blocking the calling thread and pegging a CPU core indefinitely. Fix this by rejecting a multisync extension where both in_sync_count and out_sync_count are zero in v3d_get_multisync_submit_deps(). An empty multisync carries no synchronization information and serves no useful purpose, so returning -EINVAL for such an extension is the correct defense against this attack vector.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: e4165ae8304e5ea822fbe5909dd3be5445c058b7 , < 309abbddeca0c12714721928a819ef45e5710998 (git)
Affected: e4165ae8304e5ea822fbe5909dd3be5445c058b7 , < 4fa42a249e8cd6ed17aea04e5695b6e9001f2433 (git)
Affected: e4165ae8304e5ea822fbe5909dd3be5445c058b7 , < 9c5164781cb388d219d8f49fa0f0b04cf86ad544 (git)
Affected: e4165ae8304e5ea822fbe5909dd3be5445c058b7 , < fb44d589bf3148e13452185a6e772a7efbf2d684 (git)
Create a notification for this product.
Linux Linux Affected: 5.16
Unaffected: 0 , < 5.16 (semver)
Unaffected: 6.1.176 , ≤ 6.1.* (semver)
Unaffected: 6.18.33 , ≤ 6.18.* (semver)
Unaffected: 7.0.9 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/v3d/v3d_submit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "309abbddeca0c12714721928a819ef45e5710998",
              "status": "affected",
              "version": "e4165ae8304e5ea822fbe5909dd3be5445c058b7",
              "versionType": "git"
            },
            {
              "lessThan": "4fa42a249e8cd6ed17aea04e5695b6e9001f2433",
              "status": "affected",
              "version": "e4165ae8304e5ea822fbe5909dd3be5445c058b7",
              "versionType": "git"
            },
            {
              "lessThan": "9c5164781cb388d219d8f49fa0f0b04cf86ad544",
              "status": "affected",
              "version": "e4165ae8304e5ea822fbe5909dd3be5445c058b7",
              "versionType": "git"
            },
            {
              "lessThan": "fb44d589bf3148e13452185a6e772a7efbf2d684",
              "status": "affected",
              "version": "e4165ae8304e5ea822fbe5909dd3be5445c058b7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/v3d/v3d_submit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.33",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.9",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Reject empty multisync extension to prevent infinite loop\n\nv3d_get_extensions() walks a userspace-provided singly-linked list of\nioctl extensions without any bound on the chain length. A local user\ncan craft a self-referential extension (ext-\u003enext == \u0026ext) with zero\nin_sync_count and out_sync_count, which bypasses the existing duplicate-\nextension guard:\n\n    if (se-\u003ein_sync_count || se-\u003eout_sync_count)\n            return -EINVAL;\n\nThe guard never fires because v3d_get_multisync_post_deps() returns\nimmediately when count is zero, leaving both fields at zero on every\niteration. The result is an infinite loop in kernel context, blocking\nthe calling thread and pegging a CPU core indefinitely.\n\nFix this by rejecting a multisync extension where both in_sync_count\nand out_sync_count are zero in v3d_get_multisync_submit_deps(). An\nempty multisync carries no synchronization information and serves no\nuseful purpose, so returning -EINVAL for such an extension is the\ncorrect defense against this attack vector."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-19T12:00:14.686Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/309abbddeca0c12714721928a819ef45e5710998"
        },
        {
          "url": "https://git.kernel.org/stable/c/4fa42a249e8cd6ed17aea04e5695b6e9001f2433"
        },
        {
          "url": "https://git.kernel.org/stable/c/9c5164781cb388d219d8f49fa0f0b04cf86ad544"
        },
        {
          "url": "https://git.kernel.org/stable/c/fb44d589bf3148e13452185a6e772a7efbf2d684"
        }
      ],
      "title": "drm/v3d: Reject empty multisync extension to prevent infinite loop",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46314",
    "datePublished": "2026-06-08T15:50:45.305Z",
    "dateReserved": "2026-05-13T15:03:33.111Z",
    "dateUpdated": "2026-06-19T12:00:14.686Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-46314",
      "date": "2026-07-26",
      "epss": "0.00115",
      "percentile": "0.01809"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-28T01:57:46.000Z",
      "cve": "CVE-2026-46314",
      "id": "msrc_CVE-2026-46314",
      "initial_release_date": "2026-06-02T00:00:00.000Z",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "drm/v3d: Reject empty multisync extension to prevent infinite loop",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-46314.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-46314\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-06-08T17:16:50.430\",\"lastModified\":\"2026-07-23T07:10:00.113\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/v3d: Reject empty multisync extension to prevent infinite loop\\n\\nv3d_get_extensions() walks a userspace-provided singly-linked list of\\nioctl extensions without any bound on the chain length. A local user\\ncan craft a self-referential extension (ext-\u003enext == \u0026ext) with zero\\nin_sync_count and out_sync_count, which bypasses the existing duplicate-\\nextension guard:\\n\\n    if (se-\u003ein_sync_count || se-\u003eout_sync_count)\\n            return -EINVAL;\\n\\nThe guard never fires because v3d_get_multisync_post_deps() returns\\nimmediately when count is zero, leaving both fields at zero on every\\niteration. The result is an infinite loop in kernel context, blocking\\nthe calling thread and pegging a CPU core indefinitely.\\n\\nFix this by rejecting a multisync extension where both in_sync_count\\nand out_sync_count are zero in v3d_get_multisync_submit_deps(). An\\nempty multisync carries no synchronization information and serves no\\nuseful purpose, so returning -EINVAL for such an extension is the\\ncorrect defense against this attack vector.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\ndrm/v3d: Rechazar extensi\u00f3n multisync vac\u00eda para prevenir bucle infinito\\n\\nv3d_get_extensions() recorre una lista enlazada simple de extensiones ioctl proporcionada por el espacio de usuario sin ning\u00fan l\u00edmite en la longitud de la cadena. Un usuario local puede crear una extensi\u00f3n autorreferencial (ext-\u003enext == \u0026ext) con in_sync_count y out_sync_count en cero, lo que elude la protecci\u00f3n existente contra extensiones duplicadas:\\n\\n    if (se-\u003ein_sync_count || se-\u003eout_sync_count)\\n            return -EINVAL;\\n\\nLa protecci\u00f3n nunca se activa porque v3d_get_multisync_post_deps() devuelve inmediatamente cuando count es cero, dejando ambos campos en cero en cada iteraci\u00f3n. El resultado es un bucle infinito en contexto de kernel, bloqueando el hilo llamador y acaparando un n\u00facleo de CPU indefinidamente.\\n\\nSolucione esto rechazando una extensi\u00f3n multisync donde tanto in_sync_count como out_sync_count son cero en v3d_get_multisync_submit_deps(). Una multisync vac\u00eda no lleva informaci\u00f3n de sincronizaci\u00f3n y no tiene ning\u00fan prop\u00f3sito \u00fatil, por lo que devolver -EINVAL para dicha extensi\u00f3n es la defensa correcta contra este vector de ataque.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/v3d/v3d_submit.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"e4165ae8304e5ea822fbe5909dd3be5445c058b7\",\"lessThan\":\"309abbddeca0c12714721928a819ef45e5710998\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e4165ae8304e5ea822fbe5909dd3be5445c058b7\",\"lessThan\":\"4fa42a249e8cd6ed17aea04e5695b6e9001f2433\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e4165ae8304e5ea822fbe5909dd3be5445c058b7\",\"lessThan\":\"9c5164781cb388d219d8f49fa0f0b04cf86ad544\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e4165ae8304e5ea822fbe5909dd3be5445c058b7\",\"lessThan\":\"fb44d589bf3148e13452185a6e772a7efbf2d684\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/v3d/v3d_submit.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.16\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.16\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.176\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.33\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.9\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-835\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.176\",\"matchCriteriaId\":\"C4446623-5F2B-4DD8-8666-9FAAC285A757\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.18.33\",\"matchCriteriaId\":\"EDD8915F-95A2-4775-95AB-A1723BAAF160\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.0.9\",\"matchCriteriaId\":\"33ACA10B-B260-46EA-BD50-70EBE5097672\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/309abbddeca0c12714721928a819ef45e5710998\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4fa42a249e8cd6ed17aea04e5695b6e9001f2433\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9c5164781cb388d219d8f49fa0f0b04cf86ad544\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fb44d589bf3148e13452185a6e772a7efbf2d684\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-28T06:31:14+00:00",
      "cve": "CVE-2026-46314",
      "id": "CVE-2026-46314",
      "initial_release_date": "2026-06-08T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/v3d: Reject empty multisync extension to prevent infinite loop",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46314.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-21T23:53:21Z",
      "cve": "CVE-2026-46314",
      "id": "CVE-2026-46314",
      "initial_release_date": "2026-06-09T02:20:31Z",
      "product_status:first_fixed": "68",
      "product_status:known_affected": "107",
      "product_status:known_not_affected": "131",
      "product_status:recommended": "102",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-46314",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-46314.json",
      "version": "7"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.