CVE-2026-98309
drm/vc4: Use managed KMS polling to fix UAF on unbind
No known exploitation. EPSS puts it in the 7th percentile. Fixed versions are out.
What to do
Find your product and version, then upgrade to the build on the right.
- LinuxAffected: ≥ c8b75bca92cbf064b9fa125fc74a85994452e935, < b6beee927e7f4e3142032ff91b2d0417cdddc0f6Upgrade to: b6beee927e7f4e3142032ff91b2d0417cdddc0f6Affected: ≥ c8b75bca92cbf064b9fa125fc74a85994452e935, < cf0c4432bda37b02e7d430ff5017228ceb7caf0cUpgrade to: cf0c4432bda37b02e7d430ff5017228ceb7caf0cAffected: ≥ c8b75bca92cbf064b9fa125fc74a85994452e935, < ee507691c18f9fee5d4751e295ab9a7ff31d59aeUpgrade to: ee507691c18f9fee5d4751e295ab9a7ff31d59aeAffected: ≥ c8b75bca92cbf064b9fa125fc74a85994452e935, < 7f9780df677370a19b4ec9764f13b1b82073e0d9Upgrade to: 7f9780df677370a19b4ec9764f13b1b82073e0d9 + 1 more branchStated by: CVE record
Versions as the sources state them. Full version matrix after sign-in
What it is
From the CVE record
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Use managed KMS polling to fix UAF on unbind vc4_kms_load() calls drm_kms_helper_poll_init() but the driver provides no matching drm_kms_helper_poll_fini(). The output poll work stays scheduled after unbind and runs on the freed drm_device: # modprobe vc4; rmmod vc4; sleep 10 BUG: KASAN: slab-use-after-free in delayed_work_timer_fn BUG: KASAN: slab-use-after-free in drm_client_dev_hotplug [drm] Workqueue: events output_poll_execute [drm_kms_helper] Allocated by task 171: __devm_drm_dev_alloc Freed by task 262 (rmmod): drm_dev_put / component_del Use drmm_kms_helper_poll_init() so polling is finalized with the device, as other drivers do.
In plain language
No plain-language summary for this CVE yet.
Exploitation
Where each signal puts this CVE on the scale from published to confirmed exploited.
- CISA KEV
Not in the catalog. CISA has not confirmed exploitation.
- Public exploits
No public exploit or proof of concept found in the sources we track.
- EPSS
0.2% chance of exploitation activity in the next 30 days, which ranks it in the 7th percentile of scored CVEs.
Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.
Lifecycle
2 events over 0 days, from the signal feeds we watch.
- Publishedrecord updated
Affected products
Sources
References in the record
- git.kernel.org/stable/c/073a30d75f309812ed61af134f24ffef4107b13a
- git.kernel.org/stable/c/7f9780df677370a19b4ec9764f13b1b82073e0d9
- git.kernel.org/stable/c/b6beee927e7f4e3142032ff91b2d0417cdddc0f6
And 2 more references. See all after sign-in
In the news
Watch the software you run.
My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.
We'll flag the next CVE, public exploit or patch for Linux, not every advisory.
A free account adds
- The full version matrix and every affected product
- Exploit links, proofs of concept and Metasploit modules
- Email alerts for the products you watch
- The same data over REST API, MCP and CLI