In the Linux kernel, the following vulnerability has been resolved:
drm/v3d: Fix out-of-bounds read in `v3d_csd_job_run()`
When enabling UBSAN on Raspberry Pi 5, we get the following warning:
[ 387.894977] UBSAN: array-index-out-of-bounds in drivers/gpu/drm/v3d/v3d_sched.c:320:3 [ 387.903868] index 7 is out of range for type '__u32 [7]' [ 387.909692] CPU: 0 PID: 1207 Comm: kworker/u16:2 Tainted: G WC 6.10.3-v8-16k-numa #151 [ 387.919166] Hardware name: Raspberry Pi 5 Model B Rev 1.0 (DT) [ 387.925961] Workqueue: v3d_csd drm_sched_run_job_work [gpu_sched] [ 387.932525] Call trace: [ 387.935296] dump_backtrace+0x170/0x1b8 [ 387.939403] show_stack+0x20/0x38 [ 387.942907] dump_stack_lvl+0x90/0xd0 [ 387.946785] dump_stack+0x18/0x28 [ 387.950301] __ubsan_handle_out_of_bounds+0x98/0xd0 [ 387.955383] v3d_csd_job_run+0x3a8/0x438 [v3d] [ 387.960707] drm_sched_run_job_work+0x520/0x6d0 [gpu_sched] [ 387.966862] process_one_work+0x62c/0xb48 [ 387.971296] worker_thread+0x468/0x5b0 [ 387.975317] kthread+0x1c4/0x1e0 [ 387.978818] ret_from_fork+0x10/0x20 [ 387.983014] ---[ end trace ]---
This happens because the UAPI provides only seven configuration registers and we are reading the eighth position of this u32 array.
Therefore, fix the out-of-bounds read in `v3d_csd_job_run()` by accessing only seven positions on the '__u32 [7]' array. The eighth register exists indeed on V3D 7.1, but it isn't currently used. That being so, let's guarantee that it remains unused and add a note that it could be set in a future patch.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 27, 2026 | Jul 27, 2026 |
| Suse | — | Upgrade reiserfs-kmp-defaultUpgrade kernel-develUpgrade kernel-defaultUpgrade kernel-obs-buildUpgrade kernel-docsUpgrade kernel-64kb-develUpgrade kernel-zfcpdumpUpgrade kernel-macrosUpgrade kernel-64kbUpgrade kernel-sourceUpgrade kernel-symsUpgrade kernel-default-devel | Dec 5, 2025 | Dec 5, 2025 |
| Ubuntu | — | Upgrade linux-image-genericUpgrade linux-image-6.8.0-50-generic-64kUpgrade linux-image-nvidia-64kUpgrade linux-image-awsUpgrade linux-image-gkeUpgrade linux-image-oem-24.04aUpgrade linux-image-gcpUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-oracle-64kUpgrade linux-image-6.8.0-1019-gcpUpgrade linux-image-6.8.0-1020-azureUpgrade linux-image-gkeopUpgrade linux-image-virtualUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-oracleUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-generic-lpaeUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-6.8.0-1017-oracleUpgrade linux-image-oem-22.04bUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-oem-24.04Upgrade linux-image-gkeop-6.8Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-6.8.0-1019-nvidiaUpgrade linux-image-6.8.0-1002-gkeopUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-1020-awsUpgrade linux-image-lowlatencyUpgrade linux-image-kvmUpgrade linux-image-nvidia-6.8Upgrade linux-image-ibmUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-6.8.0-1019-nvidia-64kUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-ibm-classicUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-oem-22.04Upgrade linux-image-6.8.0-50-lowlatencyUpgrade linux-image-lowlatency-64kUpgrade linux-image-6.8.0-50-lowlatency-64kUpgrade linux-image-nvidiaUpgrade linux-image-6.8.0-1017-oracle-64kUpgrade linux-image-6.8.0-1019-nvidia-lowlatencyUpgrade linux-image-6.8.0-1019-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1015-gkeUpgrade linux-image-oem-22.04aUpgrade linux-image-oem-22.04cUpgrade linux-image-6.8.0-50-genericUpgrade linux-image-6.8.0-1020-azure-fdeUpgrade linux-image-azureUpgrade linux-image-generic-64kUpgrade linux-image-6.8.0-1016-raspiUpgrade linux-image-azure-fdeUpgrade linux-image-oem-22.04dUpgrade linux-image-6.8.0-1017-ibmUpgrade linux-image-raspiUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.8.0-1018-oem | Dec 13, 2024 | Sep 4, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub