PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46314 Linux CVE debrief

CVE-2026-46314 is a vulnerability in the Linux kernel's drm/v3d component. A local user can trigger an infinite loop by providing a specially crafted multisync extension with zero in_sync_count and out_sync_count, bypassing the existing duplicate-extension guard. The vulnerability has been resolved by rejecting empty multisync extensions.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-08
Original CVE updated
2026-07-23
Advisory published
2026-06-08
Advisory updated
2026-07-23

Who should care

Linux kernel users and administrators

Technical summary

The vulnerability exists in the v3d_get_extensions() function, which walks a userspace-provided singly-linked list of ioctl extensions without bounds. A local user can craft a self-referential extension with zero in_sync_count and out_sync_count, causing an infinite loop.

Defensive priority

high

Recommended defensive actions

  • Apply the patches provided by the Linux kernel maintainers [ref-4], [ref-5], [ref-6]

Evidence notes

The vulnerability was discovered and resolved by the Linux kernel maintainers.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46314 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46314

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46314 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46314

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/4fa42a249e8cd6ed17aea04e5695b6e9001f2433

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/9c5164781cb388d219d8f49fa0f0b04cf86ad544

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/fb44d589bf3148e13452185a6e772a7efbf2d684

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.