CVE-2026-46314

{"id": "CVE-2026-46314", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "e4165ae8304e5ea822fbe5909dd3be5445c058b7", "lessThan": "309abbddeca0c12714721928a819ef45e5710998", "versionType": "git"}, {"status": "affected", "version": "e4165ae8304e5ea822fbe5909dd3be5445c058b7", "lessThan": "4fa42a249e8cd6ed17aea04e5695b6e9001f2433", "versionType": "git"}, {"status": "affected", "version": "e4165ae8304e5ea822fbe5909dd3be5445c058b7", "lessThan": "9c5164781cb388d219d8f49fa0f0b04cf86ad544", "versionType": "git"}, {"status": "affected", "version": "e4165ae8304e5ea822fbe5909dd3be5445c058b7", "lessThan": "fb44d589bf3148e13452185a6e772a7efbf2d684", "versionType": "git"}], "programFiles": ["drivers/gpu/drm/v3d/v3d_submit.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.16"}, {"status": "unaffected", "version": "0", "lessThan": "5.16", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.176", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.18.33", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.9", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/gpu/drm/v3d/v3d_submit.c"], "defaultStatus": "affected"}]}], "published": "2026-06-08T17:16:50.430", "references": [{"url": "https://git.kernel.org/stable/c/309abbddeca0c12714721928a819ef45e5710998", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/4fa42a249e8cd6ed17aea04e5695b6e9001f2433", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/9c5164781cb388d219d8f49fa0f0b04cf86ad544", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/fb44d589bf3148e13452185a6e772a7efbf2d684", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-835"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Reject empty multisync extension to prevent infinite loop\n\nv3d_get_extensions() walks a userspace-provided singly-linked list of\nioctl extensions without any bound on the chain length. A local user\ncan craft a self-referential extension (ext->next == &ext) with zero\nin_sync_count and out_sync_count, which bypasses the existing duplicate-\nextension guard:\n\n if (se->in_sync_count || se->out_sync_count)\n return -EINVAL;\n\nThe guard never fires because v3d_get_multisync_post_deps() returns\nimmediately when count is zero, leaving both fields at zero on every\niteration. The result is an infinite loop in kernel context, blocking\nthe calling thread and pegging a CPU core indefinitely.\n\nFix this by rejecting a multisync extension where both in_sync_count\nand out_sync_count are zero in v3d_get_multisync_submit_deps(). An\nempty multisync carries no synchronization information and serves no\nuseful purpose, so returning -EINVAL for such an extension is the\ncorrect defense against this attack vector."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/v3d: Rechazar extensi\u00f3n multisync vac\u00eda para prevenir bucle infinito\n\nv3d_get_extensions() recorre una lista enlazada simple de extensiones ioctl proporcionada por el espacio de usuario sin ning\u00fan l\u00edmite en la longitud de la cadena. Un usuario local puede crear una extensi\u00f3n autorreferencial (ext->next == &ext) con in_sync_count y out_sync_count en cero, lo que elude la protecci\u00f3n existente contra extensiones duplicadas:\n\n if (se->in_sync_count || se->out_sync_count)\n return -EINVAL;\n\nLa protecci\u00f3n nunca se activa porque v3d_get_multisync_post_deps() devuelve inmediatamente cuando count es cero, dejando ambos campos en cero en cada iteraci\u00f3n. El resultado es un bucle infinito en contexto de kernel, bloqueando el hilo llamador y acaparando un n\u00facleo de CPU indefinidamente.\n\nSolucione esto rechazando una extensi\u00f3n multisync donde tanto in_sync_count como out_sync_count son cero en v3d_get_multisync_submit_deps(). Una multisync vac\u00eda no lleva informaci\u00f3n de sincronizaci\u00f3n y no tiene ning\u00fan prop\u00f3sito \u00fatil, por lo que devolver -EINVAL para dicha extensi\u00f3n es la defensa correcta contra este vector de ataque."}], "lastModified": "2026-07-23T07:10:00.113", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C4446623-5F2B-4DD8-8666-9FAAC285A757", "versionEndExcluding": "6.1.176", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EDD8915F-95A2-4775-95AB-A1723BAAF160", "versionEndExcluding": "6.18.33", "versionStartIncluding": "6.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "33ACA10B-B260-46EA-BD50-70EBE5097672", "versionEndExcluding": "7.0.9", "versionStartIncluding": "6.19"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}