Vulnerability-Lookup

FKIE_CVE-2026-46314

Vulnerability from fkie_nvd - Published: 2026-06-08 17:16 - Updated: 2026-07-23 07:10

Severity

5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Reject empty multisync extension to prevent infinite loop v3d_get_extensions() walks a userspace-provided singly-linked list of ioctl extensions without any bound on the chain length. A local user can craft a self-referential extension (ext->next == &ext) with zero in_sync_count and out_sync_count, which bypasses the existing duplicate- extension guard: if (se->in_sync_count || se->out_sync_count) return -EINVAL; The guard never fires because v3d_get_multisync_post_deps() returns immediately when count is zero, leaving both fields at zero on every iteration. The result is an infinite loop in kernel context, blocking the calling thread and pegging a CPU core indefinitely. Fix this by rejecting a multisync extension where both in_sync_count and out_sync_count are zero in v3d_get_multisync_submit_deps(). An empty multisync carries no synchronization information and serves no useful purpose, so returning -EINVAL for such an extension is the correct defense against this attack vector.

References

URL	Tags
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/309abbddeca0c12714721928a819ef45e5710998	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/4fa42a249e8cd6ed17aea04e5695b6e9001f2433	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/9c5164781cb388d219d8f49fa0f0b04cf86ad544	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/fb44d589bf3148e13452185a6e772a7efbf2d684	Patch

Impacted products

Vendor	Product	Version
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/v3d/v3d_submit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "309abbddeca0c12714721928a819ef45e5710998",
              "status": "affected",
              "version": "e4165ae8304e5ea822fbe5909dd3be5445c058b7",
              "versionType": "git"
            },
            {
              "lessThan": "4fa42a249e8cd6ed17aea04e5695b6e9001f2433",
              "status": "affected",
              "version": "e4165ae8304e5ea822fbe5909dd3be5445c058b7",
              "versionType": "git"
            },
            {
              "lessThan": "9c5164781cb388d219d8f49fa0f0b04cf86ad544",
              "status": "affected",
              "version": "e4165ae8304e5ea822fbe5909dd3be5445c058b7",
              "versionType": "git"
            },
            {
              "lessThan": "fb44d589bf3148e13452185a6e772a7efbf2d684",
              "status": "affected",
              "version": "e4165ae8304e5ea822fbe5909dd3be5445c058b7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/v3d/v3d_submit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C4446623-5F2B-4DD8-8666-9FAAC285A757",
              "versionEndExcluding": "6.1.176",
              "versionStartIncluding": "5.16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "EDD8915F-95A2-4775-95AB-A1723BAAF160",
              "versionEndExcluding": "6.18.33",
              "versionStartIncluding": "6.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "33ACA10B-B260-46EA-BD50-70EBE5097672",
              "versionEndExcluding": "7.0.9",
              "versionStartIncluding": "6.19",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Reject empty multisync extension to prevent infinite loop\n\nv3d_get_extensions() walks a userspace-provided singly-linked list of\nioctl extensions without any bound on the chain length. A local user\ncan craft a self-referential extension (ext-\u003enext == \u0026ext) with zero\nin_sync_count and out_sync_count, which bypasses the existing duplicate-\nextension guard:\n\n    if (se-\u003ein_sync_count || se-\u003eout_sync_count)\n            return -EINVAL;\n\nThe guard never fires because v3d_get_multisync_post_deps() returns\nimmediately when count is zero, leaving both fields at zero on every\niteration. The result is an infinite loop in kernel context, blocking\nthe calling thread and pegging a CPU core indefinitely.\n\nFix this by rejecting a multisync extension where both in_sync_count\nand out_sync_count are zero in v3d_get_multisync_submit_deps(). An\nempty multisync carries no synchronization information and serves no\nuseful purpose, so returning -EINVAL for such an extension is the\ncorrect defense against this attack vector."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/v3d: Rechazar extensi\u00f3n multisync vac\u00eda para prevenir bucle infinito\n\nv3d_get_extensions() recorre una lista enlazada simple de extensiones ioctl proporcionada por el espacio de usuario sin ning\u00fan l\u00edmite en la longitud de la cadena. Un usuario local puede crear una extensi\u00f3n autorreferencial (ext-\u003enext == \u0026ext) con in_sync_count y out_sync_count en cero, lo que elude la protecci\u00f3n existente contra extensiones duplicadas:\n\n    if (se-\u003ein_sync_count || se-\u003eout_sync_count)\n            return -EINVAL;\n\nLa protecci\u00f3n nunca se activa porque v3d_get_multisync_post_deps() devuelve inmediatamente cuando count es cero, dejando ambos campos en cero en cada iteraci\u00f3n. El resultado es un bucle infinito en contexto de kernel, bloqueando el hilo llamador y acaparando un n\u00facleo de CPU indefinidamente.\n\nSolucione esto rechazando una extensi\u00f3n multisync donde tanto in_sync_count como out_sync_count son cero en v3d_get_multisync_submit_deps(). Una multisync vac\u00eda no lleva informaci\u00f3n de sincronizaci\u00f3n y no tiene ning\u00fan prop\u00f3sito \u00fatil, por lo que devolver -EINVAL para dicha extensi\u00f3n es la defensa correcta contra este vector de ataque."
    }
  ],
  "id": "CVE-2026-46314",
  "lastModified": "2026-07-23T07:10:00.113",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2026-06-08T17:16:50.430",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/309abbddeca0c12714721928a819ef45e5710998"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/4fa42a249e8cd6ed17aea04e5695b6e9001f2433"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/9c5164781cb388d219d8f49fa0f0b04cf86ad544"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/fb44d589bf3148e13452185a6e772a7efbf2d684"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-835"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2026-46314 (GCVE-0-2026-46314)

Vulnerability from cvelistv5 – Published: 2026-06-08 15:50 – Updated: 2026-06-19 12:00

Title

drm/v3d: Reject empty multisync extension to prevent infinite loop

Summary

Severity

No CVSS data available.

Assigner

Linux

References

4 references

URL	Tags
https://git.kernel.org/stable/c/309abbddeca0c1271…
https://git.kernel.org/stable/c/4fa42a249e8cd6ed1…
https://git.kernel.org/stable/c/9c5164781cb388d21…
https://git.kernel.org/stable/c/fb44d589bf3148e13…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: e4165ae8304e5ea822fbe5909dd3be5445c058b7 , < 309abbddeca0c12714721928a819ef45e5710998 (git) Affected: e4165ae8304e5ea822fbe5909dd3be5445c058b7 , < 4fa42a249e8cd6ed17aea04e5695b6e9001f2433 (git) Affected: e4165ae8304e5ea822fbe5909dd3be5445c058b7 , < 9c5164781cb388d219d8f49fa0f0b04cf86ad544 (git) Affected: e4165ae8304e5ea822fbe5909dd3be5445c058b7 , < fb44d589bf3148e13452185a6e772a7efbf2d684 (git)
Linux	Linux	Affected: 5.16 Unaffected: 0 , < 5.16 (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.18.33 , ≤ 6.18.* (semver) Unaffected: 7.0.9 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/v3d/v3d_submit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "309abbddeca0c12714721928a819ef45e5710998",
              "status": "affected",
              "version": "e4165ae8304e5ea822fbe5909dd3be5445c058b7",
              "versionType": "git"
            },
            {
              "lessThan": "4fa42a249e8cd6ed17aea04e5695b6e9001f2433",
              "status": "affected",
              "version": "e4165ae8304e5ea822fbe5909dd3be5445c058b7",
              "versionType": "git"
            },
            {
              "lessThan": "9c5164781cb388d219d8f49fa0f0b04cf86ad544",
              "status": "affected",
              "version": "e4165ae8304e5ea822fbe5909dd3be5445c058b7",
              "versionType": "git"
            },
            {
              "lessThan": "fb44d589bf3148e13452185a6e772a7efbf2d684",
              "status": "affected",
              "version": "e4165ae8304e5ea822fbe5909dd3be5445c058b7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/v3d/v3d_submit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.33",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.9",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Reject empty multisync extension to prevent infinite loop\n\nv3d_get_extensions() walks a userspace-provided singly-linked list of\nioctl extensions without any bound on the chain length. A local user\ncan craft a self-referential extension (ext-\u003enext == \u0026ext) with zero\nin_sync_count and out_sync_count, which bypasses the existing duplicate-\nextension guard:\n\n    if (se-\u003ein_sync_count || se-\u003eout_sync_count)\n            return -EINVAL;\n\nThe guard never fires because v3d_get_multisync_post_deps() returns\nimmediately when count is zero, leaving both fields at zero on every\niteration. The result is an infinite loop in kernel context, blocking\nthe calling thread and pegging a CPU core indefinitely.\n\nFix this by rejecting a multisync extension where both in_sync_count\nand out_sync_count are zero in v3d_get_multisync_submit_deps(). An\nempty multisync carries no synchronization information and serves no\nuseful purpose, so returning -EINVAL for such an extension is the\ncorrect defense against this attack vector."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-19T12:00:14.686Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/309abbddeca0c12714721928a819ef45e5710998"
        },
        {
          "url": "https://git.kernel.org/stable/c/4fa42a249e8cd6ed17aea04e5695b6e9001f2433"
        },
        {
          "url": "https://git.kernel.org/stable/c/9c5164781cb388d219d8f49fa0f0b04cf86ad544"
        },
        {
          "url": "https://git.kernel.org/stable/c/fb44d589bf3148e13452185a6e772a7efbf2d684"
        }
      ],
      "title": "drm/v3d: Reject empty multisync extension to prevent infinite loop",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46314",
    "datePublished": "2026-06-08T15:50:45.305Z",
    "dateReserved": "2026-05-13T15:03:33.111Z",
    "dateUpdated": "2026-06-19T12:00:14.686Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

FKIE_CVE-2026-46314

CVE-2026-46314 (GCVE-0-2026-46314)

Tags

Sightings

Nomenclature