Skip to main content

Linux Kernel V3D CVE-2026-46314

| EUVDEUVD-2026-35124 MEDIUM
Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)
2026-06-08 Linux GHSA-24m2-rchh-h2mx
Denial Of Service Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain local shell access
  2. Delivery
    Verify V3D DRI device access
  3. Exploit
    Craft self-referential multisync extension (ext->next = &ext, counts = 0)
  4. Execution
    Submit via V3D ioctl
  5. Persist
    Kernel enters infinite loop
  6. Impact
    CPU core pinned indefinitely

Vulnerability Assessment

Weakness
CWE
CWE-835
ASVS 5.0
V15 - Secure Coding and Architecture Loop termination conditions
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

The drm/v3d kernel driver must be loaded and the attacker must have read-write access to the corresponding DRI render device node (typically /dev/dri/renderD128 or similar), which on default Linux configurations is accessible to members of the 'render' or 'video' group but not to arbitrary unprivileged users. Exploitation therefore requires either membership in the appropriate device group, or a prior local privilege step sufficient to gain that access. The V3D hardware (Broadcom VideoCore VI GPU) must be present; this driver does not load on systems without this GPU. There is no remote attack path. What limits exploitation: local access required (AV:L), low but non-zero privilege threshold (PR:L, device group membership), hardware-specific driver must be loaded, and impact is purely availability (no credential theft, no code execution, no persistence).
Impact

Real-world risk is moderate-low despite the H availability rating. The CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H vector correctly reflects that exploitation requires physical or shell-level local access with at least a low-privilege account - this is not remotely triggerable. EPSS at 0.02% (4th percentile) reinforces that mass exploitation is not anticipated; this is consistent with the niche hardware footprint of the V3D driver. The vulnerability is not listed in CISA KEV, and no POC has been identified. The practical blast radius is limited to a CPU denial-of-service on hardware equipped with Broadcom VideoCore VI GPU, primarily Raspberry Pi 4 deployments. SSVC framing: exploitation is 'proof-of-concept' level at best (description provides the attack blueprint), the attack is not automatable at scale due to local-access requirement, and technical impact is partial (availability only, no code execution or privilege escalation). This vulnerability is a genuine priority only for multi-user embedded/IoT systems running the V3D driver where untrusted local users exist; it is low priority for single-user Raspberry Pi desktop use and irrelevant to most Linux server/cloud environments that lack V3D hardware.
Exploit ScenarioDerived

A low-privileged local user on a Raspberry Pi 4 or similar Broadcom VideoCore VI system allocates a multisync ioctl extension structure with in_sync_count=0, out_sync_count=0, and sets ext->next to point back to the same structure. Submitting this via the V3D render ioctl causes v3d_get_extensions() to spin indefinitely in kernel context, pegging one CPU core and starving other processes of scheduler time. No public POC code has been identified, though the description provides a precise blueprint sufficient for a moderately skilled attacker to reproduce the condition.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 08, 2026

Infinite loop denial-of-service in the Linux kernel's drm/v3d GPU driver allows a local low-privileged user to permanently peg a CPU core by submitting a crafted self-referential ioctl extension structure. The vulnerability exists in v3d_get_extensions(), which traverses a userspace-controlled linked list without bounding chain length; when both in_sync_count and out_sync_count are zero, the duplicate-extension guard silently passes on every iteration, trapping the kernel thread indefinitely. No public exploit or active exploitation has been identified at time of analysis; EPSS stands at 0.02%, consistent with the local-access-only attack surface.

RemediationAI

Upgrade to Linux kernel 6.18.33, 7.0.9, or any 7.1-rc1+ build containing the fix, available via the kernel.org stable tree. The authoritative patches are at https://git.kernel.org/stable/c/4fa42a249e8cd6ed17aea04e5695b6e9001f2433, https://git.kernel.org/stable/c/9c5164781cb388d219d8f49fa0f0b04cf86ad544, and https://git.kernel.org/stable/c/fb44d589bf3148e13452185a6e772a7efbf2d684; distributions should apply whichever corresponds to their maintained kernel branch. If patching is not immediately possible, the primary compensating control is to restrict access to the /dev/dri/renderD* device node associated with the V3D GPU - removing world-read/write permissions or placing it behind a device access group will prevent unprivileged local users from submitting crafted ioctl extensions. Trade-off: this will break GPU-accelerated rendering for all non-root users. Alternatively, blacklisting the v3d kernel module (echo 'blacklist v3d' >> /etc/modprobe.d/v3d-disable.conf) eliminates the attack surface entirely at the cost of disabling VideoCore VI GPU acceleration. Neither workaround is necessary in single-user or trusted-user environments.

Affected VersionsENISA

Linux e4165ae8304e5ea822fbe5909dd3be5445c058b7 <9c5164781cb388d219d8f49fa0f0b04cf86ad544
Linux patch: 7.1-rc1
Linux patch: 0
Linux patch: 6.18.33
Linux e4165ae8304e5ea822fbe5909dd3be5445c058b7 <4fa42a249e8cd6ed17aea04e5695b6e9001f2433
Linux e4165ae8304e5ea822fbe5909dd3be5445c058b7 <fb44d589bf3148e13452185a6e772a7efbf2d684
Linux patch: 7.0.9
Linux 5.16

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The drm/v3d subsystem provides Direct Rendering Manager support for the Broadcom VideoCore VI GPU, most notably present in Raspberry Pi 4 and similar SoC-based platforms. When userspace submits GPU jobs via ioctl, it can attach a singly-linked list of extension structures (multisync extensions) that carry synchronization fence counts. The function v3d_get_extensions() walks this list by following the ext->next pointer provided entirely from userspace. CWE-835 (Loop with Unreachable Exit Condition) is the root cause: the guard 'if (se->in_sync_count || se->out_sync_count) return -EINVAL' was intended to catch duplicate extensions, but it is bypassed when both counts are zero because v3d_get_multisync_post_deps() returns immediately for zero-count entries, leaving those fields unset on every pass. A pointer crafted as ext->next == &ext creates a cycle that the loop never escapes. The fix rejects any multisync extension with both counts at zero at the v3d_get_multisync_submit_deps() entry point. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* from the introduction commit e4165ae8304e5ea822fbe5909dd3be5445c058b7 through the stable-branch patch commits.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 5.5 MEDIUM

Local ioctl interface requires device group membership (PR:L, AV:L); no complexity beyond crafting the struct (AC:L); pure CPU-peg DoS with no data or integrity impact (C:N/I:N/A:H).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Jul 08, 2026 - 14:52 NVD
5.5 (MEDIUM)
Patch available
Jun 08, 2026 - 18:01 EUVD
CVE Published
Jun 08, 2026 - 15:50 nvd
MEDIUM 5.5
CVE Published
Jun 08, 2026 - 15:50 nvd
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

drm/v3d: Reject empty multisync extension to prevent infinite loop

v3d_get_extensions() walks a userspace-provided singly-linked list of ioctl extensions without any bound on the chain length. A local user can craft a self-referential extension (ext->next == &ext) with zero in_sync_count and out_sync_count, which bypasses the existing duplicate- extension guard:

if (se->in_sync_count || se->out_sync_count) return -EINVAL;

The guard never fires because v3d_get_multisync_post_deps() returns immediately when count is zero, leaving both fields at zero on every iteration. The result is an infinite loop in kernel context, blocking the calling thread and pegging a CPU core indefinitely.

Fix this by rejecting a multisync extension where both in_sync_count and out_sync_count are zero in v3d_get_multisync_submit_deps(). An empty multisync carries no synchronization information and serves no useful purpose, so returning -EINVAL for such an extension is the correct defense against this attack vector.

Threat Intelligence Overview

EPSS Score
0.0%
Top 96% exploitable
Prevalence
Low
Broadcom VideoCore VI GPU driver, limited to Raspberry Pi 4 and similar SoCs
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Same weakness CWE-835 – Loop with Unreachable Exit Condition (Infinite Loop)

View all
CVE-2024-20353 HIGH POC
8.6
CVE-2020-13935 HIGH POC
7.5
CVE-2017-16944 HIGH POC
7.5
CVE-2023-34966 HIGH
7.5
CVE-2022-0778 HIGH POC
7.5
CVE-2024-43366 CRITICAL POC
9.1
CVE-2026-25533 HIGH POC
8.8
CVE-2018-8002 HIGH POC
8.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.177 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.155 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.206 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.152 Affected
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-HPC-Azure Affected
Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Hardened-GCE Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-46314 ADVISORY https://ubuntu.com/security/notices/USN-8566-1 ADVISORY https://ubuntu.com/security/notices/USN-8567-1 ADVISORY https://ubuntu.com/security/notices/USN-8568-1 ADVISORY https://vuldb.com/vuln/369270 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22742/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22769/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3130/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3166/ REF https://git.kernel.org/stable/c/309abbddeca0c12714721928a819ef45e5710998 REF https://git.kernel.org/stable/c/4fa42a249e8cd6ed17aea04e5695b6e9001f2433 REF https://git.kernel.org/stable/c/9c5164781cb388d219d8f49fa0f0b04cf86ad544 REF https://git.kernel.org/stable/c/fb44d589bf3148e13452185a6e772a7efbf2d684

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy