Linux Kernel CVE-2026-93192

Requires local access to the V3D GPU DRM device (render/card node) on a system using the Broadcom V3D driver (predominantly Raspberry Pi 4/5). Exploitation is gated on v3d_fence_create() failing, i.e. a dma_fence memory-allocation failure, which only occurs under memory exhaustion - not attacker-supplied data. For the BIN queue the dangling pointer must also race against v3d_overflow_mem_work(). These factors (rare allocation failure, local device access, timing/race) substantially limit realistic exploitation; the outcome is a kernel crash rather than code execution or data disclosure.

This is a high-CVSS-but-low-real-risk issue. The vendor CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) overstates the practical severity. The vulnerability is a dangling-pointer bug in the Broadcom V3D DRM GPU driver: run_job() callbacks (BIN/RENDER/TFU/CSD) assign the incoming job to queue->active_job before calling v3d_fence_create(), and on failure return NULL without clearing it. The trigger - v3d_fence_create() failing - is a dma_fence allocation failure, which is a rare low-memory condition rather than an attacker-controlled input, so the C:H/I:H/A:H claim is not supported; the realistic outcome is a stale/freed-job dereference causing a kernel crash (DoS), not confidentiality or integrity loss. No EPSS score, no CISA KEV listing, and no public POC are present in the input, all consistent with a low-priority, non-weaponized error-path defect. The AC:L rating is questionable: reliably forcing fence-create failure requires memory-pressure conditions and (for the BIN path) a race against v3d_overflow_mem_work(), which argues for AC:H. Overall this is a routine stable-tree hardening fix, not an urgent operational priority.

A local user with access to the V3D render node submits GPU jobs while the system is under heavy memory pressure so that dma_fence allocation in v3d_fence_create() fails; the run_job() callback returns without clearing queue->active_job, leaving a dangling pointer that a subsequent job-completion or overflow path dereferences, crashing the kernel. No public exploit code is identified, and the dependence on induced allocation failure makes reliable triggering difficult.