CVE-2026-46314

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Reject empty multisync extension to prevent infinite loop v3d_get_extensions() walks a userspace-provided singly-linked list of ioctl extensions without any bound on the chain length. A local user can craft a self-referential extension (ext->next == &ext) with zero in_sync_count and out_sync_count, which bypasses the existing duplicate- extension guard: if (se->in_sync_count || se->out_sync_count) return -EINVAL; The guard never fires because v3d_get_multisync_post_deps() returns immediately when count is zero, leaving both fields at zero on every iteration. The result is an infinite loop in kernel context, blocking the calling thread and pegging a CPU core indefinitely. Fix this by rejecting a multisync extension where both in_sync_count and out_sync_count are zero in v3d_get_multisync_submit_deps(). An empty multisync carries no synchronization information and serves no useful purpose, so returning -EINVAL for such an extension is the correct defense against this attack vector.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/309abbddeca0c12714721928a819ef45e5710998	Patch
https://git.kernel.org/stable/c/4fa42a249e8cd6ed17aea04e5695b6e9001f2433	Patch
https://git.kernel.org/stable/c/9c5164781cb388d219d8f49fa0f0b04cf86ad544	Patch
https://git.kernel.org/stable/c/fb44d589bf3148e13452185a6e772a7efbf2d684	Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

History

No history.

Information

Published : 2026-06-08 17:16

Updated : 2026-07-23 07:10

NVD link : CVE-2026-46314

Mitre link : CVE-2026-46314

CVE.ORG link : CVE-2026-46314

JSON object : View

Products Affected

linux

linux_kernel

CWE

CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')

{"id": "CVE-2026-46314", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "e4165ae8304e5ea822fbe5909dd3be5445c058b7", "lessThan": "309abbddeca0c12714721928a819ef45e5710998", "versionType": "git"}, {"status": "affected", "version": "e4165ae8304e5ea822fbe5909dd3be5445c058b7", "lessThan": "4fa42a249e8cd6ed17aea04e5695b6e9001f2433", "versionType": "git"}, {"status": "affected", "version": "e4165ae8304e5ea822fbe5909dd3be5445c058b7", "lessThan": "9c5164781cb388d219d8f49fa0f0b04cf86ad544", "versionType": "git"}, {"status": "affected", "version": "e4165ae8304e5ea822fbe5909dd3be5445c058b7", "lessThan": "fb44d589bf3148e13452185a6e772a7efbf2d684", "versionType": "git"}], "programFiles": ["drivers/gpu/drm/v3d/v3d_submit.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.16"}, {"status": "unaffected", "version": "0", "lessThan": "5.16", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.176", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.18.33", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.9", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/gpu/drm/v3d/v3d_submit.c"], "defaultStatus": "affected"}]}], "published": "2026-06-08T17:16:50.430", "references": [{"url": "https://git.kernel.org/stable/c/309abbddeca0c12714721928a819ef45e5710998", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/4fa42a249e8cd6ed17aea04e5695b6e9001f2433", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/9c5164781cb388d219d8f49fa0f0b04cf86ad544", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/fb44d589bf3148e13452185a6e772a7efbf2d684", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-835"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Reject empty multisync extension to prevent infinite loop\n\nv3d_get_extensions() walks a userspace-provided singly-linked list of\nioctl extensions without any bound on the chain length. A local user\ncan craft a self-referential extension (ext->next == &ext) with zero\nin_sync_count and out_sync_count, which bypasses the existing duplicate-\nextension guard:\n\n if (se->in_sync_count || se->out_sync_count)\n return -EINVAL;\n\nThe guard never fires because v3d_get_multisync_post_deps() returns\nimmediately when count is zero, leaving both fields at zero on every\niteration. The result is an infinite loop in kernel context, blocking\nthe calling thread and pegging a CPU core indefinitely.\n\nFix this by rejecting a multisync extension where both in_sync_count\nand out_sync_count are zero in v3d_get_multisync_submit_deps(). An\nempty multisync carries no synchronization information and serves no\nuseful purpose, so returning -EINVAL for such an extension is the\ncorrect defense against this attack vector."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/v3d: Rechazar extensi\u00f3n multisync vac\u00eda para prevenir bucle infinito\n\nv3d_get_extensions() recorre una lista enlazada simple de extensiones ioctl proporcionada por el espacio de usuario sin ning\u00fan l\u00edmite en la longitud de la cadena. Un usuario local puede crear una extensi\u00f3n autorreferencial (ext->next == &ext) con in_sync_count y out_sync_count en cero, lo que elude la protecci\u00f3n existente contra extensiones duplicadas:\n\n if (se->in_sync_count || se->out_sync_count)\n return -EINVAL;\n\nLa protecci\u00f3n nunca se activa porque v3d_get_multisync_post_deps() devuelve inmediatamente cuando count es cero, dejando ambos campos en cero en cada iteraci\u00f3n. El resultado es un bucle infinito en contexto de kernel, bloqueando el hilo llamador y acaparando un n\u00facleo de CPU indefinidamente.\n\nSolucione esto rechazando una extensi\u00f3n multisync donde tanto in_sync_count como out_sync_count son cero en v3d_get_multisync_submit_deps(). Una multisync vac\u00eda no lleva informaci\u00f3n de sincronizaci\u00f3n y no tiene ning\u00fan prop\u00f3sito \u00fatil, por lo que devolver -EINVAL para dicha extensi\u00f3n es la defensa correcta contra este vector de ataque."}], "lastModified": "2026-07-23T07:10:00.113", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C4446623-5F2B-4DD8-8666-9FAAC285A757", "versionEndExcluding": "6.1.176", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EDD8915F-95A2-4775-95AB-A1723BAAF160", "versionEndExcluding": "6.18.33", "versionStartIncluding": "6.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "33ACA10B-B260-46EA-BD50-70EBE5097672", "versionEndExcluding": "7.0.9", "versionStartIncluding": "6.19"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}