Review reviewHigh

CVE-2026-64099

Linux

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Fix use-after-free of CPU job query arrays on error path The CPU job ioctl's fail label calls kvfree() on cpu_job's timestamp and performance query arrays after v3d_job_cleanup(), which drops the job's last reference and frees cpu_job. Reading cpu_job at that point is a use-after-free. Also, on the early v3d_job_init() failure path, it is a NULL dereference, since v3d_job_deallocate() zeroes the local pointer. In the success path, the arrays are released from the scheduler's .free_job callback, but on the error pat...

CVSS: 7.8
EPSS: -
CISA KEV: Not listed
Published: 2026.07.20

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability-

Technical severityCVSS 7.8

Vulnerability overview

Affected product and versions

Product: Linux
Affected versions: >= 9ba0ff3e083f6a4a0b6698f06bfff74805fefa5f < acd55ea40d03e06f20a9986363019e0e5173990e, >= 9ba0ff3e083f6a4a0b6698f06bfff74805fefa5f < 0f8efc45740b0628a787d1b0be8a0ddabd700625, >= 9ba0ff3e083f6a4a0b6698f06bfff74805fefa5f < 69c2a1fec2e7ca25598180816f3bc56e1842eb41, >= 9ba0ff3e083f6a4a0b6698f06bfff74805fefa5f < b0fe80c0b9250b35e2211bf3117e7aca814a21b0, >= 6.8
Fixed versions: No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Linux and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: Not available