CVE-2026-74638

A flaw was found in the Linux kernel's drm/v3d driver. This vulnerability arises from concurrent handling of scheduler timeout events across different hardware queues, which share a single global reset mechanism. When a reset occurs in one queue while another is processing a timeout, the scheduler's credit counting can become corrupted. This can lead to a complete GPU hang and user interface freeze, effectively causing a Denial of Service.

A MODERATE severity denial-of-service flaw was found in the Linux kernel drm/v3d driver used on Broadcom V3D GPU hardware. The V3D driver exposes several independent hardware queues (BIN, RENDER, TFU and CSD) but has only a single global reset, and the driver's reset_lock cannot serialize the DRM scheduler timeout handlers because it only covers the driver's timedout_job callback. As a result, when a global reset triggered by one queue stops and restarts another queue's scheduler while that queue is concurrently handling a timeout of its own, the job credits subtracted by drm_sched_stop() and re-added by drm_sched_start() no longer match, leaving the affected queue with more credits in flight than its limit. A local user able to run GPU workloads, such as a CL-intensive application that triggers job timeouts, could exploit this race condition to corrupt the scheduler's credit accounting and cause a complete GPU hang and user interface freeze. Red Hat Enterprise Linux and Red Hat In-Vehicle OS are not affected by this flaw because the vulnerable drm/v3d code is not present in the Red Hat shipped kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.