CVE-2026-64099 Linux CVE debrief

Who should care

Linux kernel developers, Linux distribution maintainers, and organizations that rely on the Linux kernel should be aware of this vulnerability and take steps to mitigate it. This includes reviewing and applying patches, ensuring that the Linux kernel is updated to a version that includes the fix, and monitoring for potential exploitation of this vulnerability. Additionally, security teams and vulnerability management teams should prioritize this vulnerability based on its potential impact and ensure that affected systems are properly mitigated.

Technical summary

The vulnerability occurs in the Linux kernel's drm/v3d component, specifically in the CPU job ioctl's fail label. The fail label calls kvfree() on cpu_job's timestamp and performance query arrays after v3d_job_cleanup(), which drops the job's last reference and frees cpu_job. This results in a use-after-free and a NULL dereference on the early v3d_job_init() failure path. The manual kvfree() calls only free the array storage and do not drm_syncobj_put() the per-query syncobjs, leading to a syncobj reference leak. To fix this vulnerability, the CPU job teardown should be unified into the CPU job's kref destructor, mirroring v3d_render_job_free(). The scheduler's .free_job slot should revert to the generic v3d_sched_job_free() and the fail label should drop the manual kvfree() calls.

Defensive priority

High

Recommended defensive actions

• Review and apply the patch to the Linux kernel's drm/v3d component
• Ensure that the Linux kernel is updated to a version that includes the fix
• Monitor for potential exploitation of this vulnerability
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was resolved in the Linux kernel. The fix unifies the CPU job teardown into the CPU job's kref destructor, mirroring v3d_render_job_free(). The scheduler's .free_job slot reverts to the generic v3d_sched_job_free() and the fail label drops the manual kvfree() calls.

Official resources