CVE-2026-72327

A flaw was found in the Linux kernel's drm/v3d component. The v3d_get_cpu_indirect_csd_params() function does not properly validate a userspace-supplied indirect buffer object (BO) handle. An attacker, by providing a bogus or stale handle, can cause a NULL pointer dereference. This can lead to a system crash, resulting in a Denial of Service (DoS).

A low impact flaw was found in the Linux kernel drm/v3d driver. The v3d_get_cpu_indirect_csd_params() function looks up an indirect buffer object (BO) from a userspace-supplied handle without validating the result. A local user with access to the V3D DRM device could submit a bogus or stale handle, causing drm_gem_object_lookup() to return NULL; the NULL pointer is stored and later dereferenced when the indirect CSD job runs, crashing the kernel and resulting in a denial of service. There is no impact on confidentiality or integrity. All currently assessed Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel streams are not affected because the vulnerable code is not present in the shipped kernels. Although the CVSS:3.1 base score is 5.5 (moderate), the overall Red Hat impact is rated low because exploitation requires local access to the V3D DRM device and the consequence is limited to a system crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.