Linux Kernel V3D CVE-2026-46314

The drm/v3d subsystem provides Direct Rendering Manager support for the Broadcom VideoCore VI GPU, most notably present in Raspberry Pi 4 and similar SoC-based platforms. When userspace submits GPU jobs via ioctl, it can attach a singly-linked list of extension structures (multisync extensions) that carry synchronization fence counts. The function v3d_get_extensions() walks this list by following the ext->next pointer provided entirely from userspace. CWE-835 (Loop with Unreachable Exit Condition) is the root cause: the guard 'if (se->in_sync_count || se->out_sync_count) return -EINVAL' was intended to catch duplicate extensions, but it is bypassed when both counts are zero because v3d_get_multisync_post_deps() returns immediately for zero-count entries, leaving those fields unset on every pass. A pointer crafted as ext->next == &ext creates a cycle that the loop never escapes. The fix rejects any multisync extension with both counts at zero at the v3d_get_multisync_submit_deps() entry point. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* from the introduction commit e4165ae8304e5ea822fbe5909dd3be5445c058b7 through the stable-branch patch commits.