CVE-2026-72327

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

drm/v3d: Reject invalid indirect BO handle in indirect CSD setup

v3d_get_cpu_indirect_csd_params() looks up the indirect buffer object

from a userspace-supplied handle but never checks the result. A bogus

or stale handle makes drm_gem_object_lookup() return NULL, which is

then stored in info->indirect and only dereferenced later when the

indirect CSD job runs, turning a userspace mistake into a NULL pointer

dereference in the kernel.

Bail out with -ENOENT as soon as the lookup fails, so the bad handle is

rejected at submission time.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References