CVE-2026-64099

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/v3d: Fix use-after-free of CPU job query arrays on error path<br /> <br /> The CPU job ioctl&amp;#39;s fail label calls kvfree() on cpu_job&amp;#39;s timestamp and<br /> performance query arrays after v3d_job_cleanup(), which drops the job&amp;#39;s<br /> last reference and frees cpu_job. Reading cpu_job at that point is a<br /> use-after-free. Also, on the early v3d_job_init() failure path, it is a<br /> NULL dereference, since v3d_job_deallocate() zeroes the local pointer.<br /> <br /> In the success path, the arrays are released from the scheduler&amp;#39;s<br /> .free_job callback, but on the error path, they are freed manually, as<br /> the job was never pushed to the scheduler. While the success path deals<br /> with this correctly, the fail path doesn&amp;#39;t.<br /> <br /> On top of that, the manual kvfree() calls only free the array storage;<br /> they don&amp;#39;t drm_syncobj_put() the per-query syncobjs that<br /> v3d_timestamp_query_info_free() and v3d_performance_query_info_free()<br /> release on the success path. So the same fail path that triggers the<br /> use-after-free also leaks one syncobj reference per query.<br /> <br /> Unify the CPU job teardown into the CPU job&amp;#39;s kref destructor, mirroring<br /> v3d_render_job_free(). The scheduler&amp;#39;s .free_job slot reverts to the<br /> generic v3d_sched_job_free() and the fail label drops the manual<br /> kvfree() calls, leaving a single teardown path that is reached from both<br /> the scheduler and the ioctl error path. That removes the use-after-free,<br /> the NULL dereference, and the syncobj leak by construction.