CVE-2026-46314
drm/v3d: Reject empty multisync extension to prevent infinite loop
Description
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Reject empty multisync extension to prevent infinite loop v3d_get_extensions() walks a userspace-provided singly-linked list of ioctl extensions without any bound on the chain length. A local user can craft a self-referential extension (ext->next == &ext) with zero in_sync_count and out_sync_count, which bypasses the existing duplicate- extension guard: if (se->in_sync_count || se->out_sync_count) return -EINVAL; The guard never fires because v3d_get_multisync_post_deps() returns immediately when count is zero, leaving both fields at zero on every iteration. The result is an infinite loop in kernel context, blocking the calling thread and pegging a CPU core indefinitely. Fix this by rejecting a multisync extension where both in_sync_count and out_sync_count are zero in v3d_get_multisync_submit_deps(). An empty multisync carries no synchronization information and serves no useful purpose, so returning -EINVAL for such an extension is the correct defense against this attack vector.
INFO
Published Date :
June 8, 2026, 5:16 p.m.
Last Modified :
July 23, 2026, 7:10 a.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | [email protected] |
Solution
- Apply kernel patches that reject zero-count multisync extensions.
- Update the Linux kernel to a patched version.
- Reject multisync extensions where in_sync_count and out_sync_count are zero.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-46314.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-46314 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-46314
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-46314 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-46314 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Jul. 23, 2026
Action Type Old Value New Value Added Translation Title: Linux, Description: En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: drm/v3d: Rechazar extensión multisync vacía para prevenir bucle infinito v3d_get_extensions() recorre una lista enlazada simple de extensiones ioctl proporcionada por el espacio de usuario sin ningún límite en la longitud de la cadena. Un usuario local puede crear una extensión autorreferencial (ext->next == &ext) con in_sync_count y out_sync_count en cero, lo que elude la protección existente contra extensiones duplicadas: if (se->in_sync_count || se->out_sync_count) return -EINVAL; La protección nunca se activa porque v3d_get_multisync_post_deps() devuelve inmediatamente cuando count es cero, dejando ambos campos en cero en cada iteración. El resultado es un bucle infinito en contexto de kernel, bloqueando el hilo llamador y acaparando un núcleo de CPU indefinidamente. Solucione esto rechazando una extensión multisync donde tanto in_sync_count como out_sync_count son cero en v3d_get_multisync_submit_deps(). Una multisync vacía no lleva información de sincronización y no tiene ningún propósito útil, por lo que devolver -EINVAL para dicha extensión es la defensa correcta contra este vector de ataque. -
Initial Analysis by [email protected]
Jul. 08, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Added CWE CWE-835 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.0.9 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.176 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.18.33 Added Reference Type kernel.org: https://git.kernel.org/stable/c/309abbddeca0c12714721928a819ef45e5710998 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/4fa42a249e8cd6ed17aea04e5695b6e9001f2433 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/9c5164781cb388d219d8f49fa0f0b04cf86ad544 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/fb44d589bf3148e13452185a6e772a7efbf2d684 Types: Patch -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 19, 2026
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/309abbddeca0c12714721928a819ef45e5710998 Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'e4165ae8304e5ea822fbe5909dd3be5445c058b7', 'lessThan': '4fa42a249e8cd6ed17aea04e5695b6e9001f2433', 'versionType': 'git'}, {'status': 'affected', 'version': 'e4165ae8304e5ea822fbe5909dd3be5445c058b7', 'lessThan': '9c5164781cb388d219d8f49fa0f0b04cf86ad544', 'versionType': 'git'}, {'status': 'affected', 'version': 'e4165ae8304e5ea822fbe5909dd3be5445c058b7', 'lessThan': 'fb44d589bf3148e13452185a6e772a7efbf2d684', 'versionType': 'git'}], 'programFiles': ['drivers/gpu/drm/v3d/v3d_submit.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.16'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.16', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.18.33', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.9', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/gpu/drm/v3d/v3d_submit.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'e4165ae8304e5ea822fbe5909dd3be5445c058b7', 'lessThan': '309abbddeca0c12714721928a819ef45e5710998', 'versionType': 'git'}, {'status': 'affected', 'version': 'e4165ae8304e5ea822fbe5909dd3be5445c058b7', 'lessThan': '4fa42a249e8cd6ed17aea04e5695b6e9001f2433', 'versionType': 'git'}, {'status': 'affected', 'version': 'e4165ae8304e5ea822fbe5909dd3be5445c058b7', 'lessThan': '9c5164781cb388d219d8f49fa0f0b04cf86ad544', 'versionType': 'git'}, {'status': 'affected', 'version': 'e4165ae8304e5ea822fbe5909dd3be5445c058b7', 'lessThan': 'fb44d589bf3148e13452185a6e772a7efbf2d684', 'versionType': 'git'}], 'programFiles': ['drivers/gpu/drm/v3d/v3d_submit.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.16'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.16', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.1.176', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.18.33', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.9', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/gpu/drm/v3d/v3d_submit.c'], 'defaultStatus': 'affected'}] -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'e4165ae8304e5ea822fbe5909dd3be5445c058b7', 'lessThan': '4fa42a249e8cd6ed17aea04e5695b6e9001f2433', 'versionType': 'git'}, {'status': 'affected', 'version': 'e4165ae8304e5ea822fbe5909dd3be5445c058b7', 'lessThan': '9c5164781cb388d219d8f49fa0f0b04cf86ad544', 'versionType': 'git'}, {'status': 'affected', 'version': 'e4165ae8304e5ea822fbe5909dd3be5445c058b7', 'lessThan': 'fb44d589bf3148e13452185a6e772a7efbf2d684', 'versionType': 'git'}], 'programFiles': ['drivers/gpu/drm/v3d/v3d_submit.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.16'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.16', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.18.33', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.9', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/gpu/drm/v3d/v3d_submit.c'], 'defaultStatus': 'affected'}] -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 08, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Reject empty multisync extension to prevent infinite loop v3d_get_extensions() walks a userspace-provided singly-linked list of ioctl extensions without any bound on the chain length. A local user can craft a self-referential extension (ext->next == &ext) with zero in_sync_count and out_sync_count, which bypasses the existing duplicate- extension guard: if (se->in_sync_count || se->out_sync_count) return -EINVAL; The guard never fires because v3d_get_multisync_post_deps() returns immediately when count is zero, leaving both fields at zero on every iteration. The result is an infinite loop in kernel context, blocking the calling thread and pegging a CPU core indefinitely. Fix this by rejecting a multisync extension where both in_sync_count and out_sync_count are zero in v3d_get_multisync_submit_deps(). An empty multisync carries no synchronization information and serves no useful purpose, so returning -EINVAL for such an extension is the correct defense against this attack vector. Added Reference https://git.kernel.org/stable/c/4fa42a249e8cd6ed17aea04e5695b6e9001f2433 Added Reference https://git.kernel.org/stable/c/9c5164781cb388d219d8f49fa0f0b04cf86ad544 Added Reference https://git.kernel.org/stable/c/fb44d589bf3148e13452185a6e772a7efbf2d684