All vulnerabilities
CVE-2026-98309

Linux: drm/vc4: Use managed KMS polling to fix UAF on unbind

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in7f9780df677370a19b4ec9764f13b1b82073e0d9Also 073a30d75f309812ed61af134f24ffef4107b13aCVE List
Published6 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 7f9780df677370a19b4ec9764f13b1b82073e0d9LinuxCVE List
  • 073a30d75f309812ed61af134f24ffef4107b13aLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/vc4: Use managed KMS polling to fix UAF on unbind

vc4_kms_load() calls drm_kms_helper_poll_init() but the driver provides no matching drm_kms_helper_poll_fini(). The output poll work stays scheduled after unbind and runs on the freed drm_device:

modprobe vc4; rmmod vc4; sleep 10

BUG: KASAN: slab-use-after-free in delayed_work_timer_fn BUG: KASAN: slab-use-after-free in drm_client_dev_hotplug [drm] Workqueue: events output_poll_execute [drm_kms_helper] Allocated by task 171: __devm_drm_dev_alloc Freed by task 262 (rmmod): drm_dev_put / component_del

Use drmm_kms_helper_poll_init() so polling is finalized with the device, as other drivers do.

Text from CVE List

Affected versions 12

  • Linuxaffected: c8b75bca92cbf064b9fa125fc74a85994452e935 before b6beee927e7f4e3142032ff91b2d0417cdddc0f6CVE List
  • Linuxaffected: c8b75bca92cbf064b9fa125fc74a85994452e935 before cf0c4432bda37b02e7d430ff5017228ceb7caf0cCVE List
  • Linuxaffected: c8b75bca92cbf064b9fa125fc74a85994452e935 before ee507691c18f9fee5d4751e295ab9a7ff31d59aeCVE List
  • Linuxaffected: c8b75bca92cbf064b9fa125fc74a85994452e935 before 7f9780df677370a19b4ec9764f13b1b82073e0d9CVE List
  • Linuxaffected: c8b75bca92cbf064b9fa125fc74a85994452e935 before 073a30d75f309812ed61af134f24ffef4107b13aCVE List
  • Linuxaffected: 4.4CVE List
  • Linuxunaffected: all versions before 4.4CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.54 through 6.18.*CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5