GHSA-FCMJ-9H4R-58R4
Vulnerability from github – Published: 2026-10-06 09:31 – Updated: 2026-10-06 09:31In the Linux kernel, the following vulnerability has been resolved:
drm/vc4: Use managed KMS polling to fix UAF on unbind
vc4_kms_load() calls drm_kms_helper_poll_init() but the driver provides no matching drm_kms_helper_poll_fini(). The output poll work stays scheduled after unbind and runs on the freed drm_device:
# modprobe vc4; rmmod vc4; sleep 10 BUG: KASAN: slab-use-after-free in delayed_work_timer_fn BUG: KASAN: slab-use-after-free in drm_client_dev_hotplug [drm] Workqueue: events output_poll_execute [drm_kms_helper] Allocated by task 171: __devm_drm_dev_alloc Freed by task 262 (rmmod): drm_dev_put / component_del
Use drmm_kms_helper_poll_init() so polling is finalized with the device, as other drivers do.
{
"affected": [],
"aliases": [
"CVE-2026-98309"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-06T09:18:22Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: Use managed KMS polling to fix UAF on unbind\n\nvc4_kms_load() calls drm_kms_helper_poll_init() but the driver provides\nno matching drm_kms_helper_poll_fini(). The output poll work stays\nscheduled after unbind and runs on the freed drm_device:\n\n # modprobe vc4; rmmod vc4; sleep 10\n BUG: KASAN: slab-use-after-free in delayed_work_timer_fn\n BUG: KASAN: slab-use-after-free in drm_client_dev_hotplug [drm]\n Workqueue: events output_poll_execute [drm_kms_helper]\n Allocated by task 171: __devm_drm_dev_alloc\n Freed by task 262 (rmmod): drm_dev_put / component_del\n\nUse drmm_kms_helper_poll_init() so polling is finalized with the device,\nas other drivers do.",
"id": "GHSA-fcmj-9h4r-58r4",
"modified": "2026-10-06T09:31:34Z",
"published": "2026-10-06T09:31:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98309"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/073a30d75f309812ed61af134f24ffef4107b13a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7f9780df677370a19b4ec9764f13b1b82073e0d9"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b6beee927e7f4e3142032ff91b2d0417cdddc0f6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/cf0c4432bda37b02e7d430ff5017228ceb7caf0c"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ee507691c18f9fee5d4751e295ab9a7ff31d59ae"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.