{
  "cveId": "CVE-2026-99095",
  "url": "https://patchblox.com/security/cve/CVE-2026-99095",
  "summary": "CVE-2026-99095 is fixed in linux on 1 platform, first by DEBIAN-CVE-2026-99095, released October 27, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "drm/vc4: drain the hangcheck timer and works on V3D unbind",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  drm/vc4: drain the hangcheck timer and works on V3D unbind  Nothing stops the hangcheck timer that submitted jobs arm, or the job_done_work that the render-done interrupt queues, at teardown: vc4_irq_disable() cancels only overflow_mem_work, and vc4_gem_destroy() runs from the drm-managed release, after vc4_v3d_unbind() has already uninstalled the V3D interrupt and cleared vc4-\u003Ev3d. A timer still armed by then reads V3D registers through the NULL vc4-\u003Ev3d pointer, and the late callbacks run on the vc4_dev embedding them after it has been freed.  Drain them in vc4_v3d_unbind(): shut the timer down and cancel reset_work before the interrupt is taken down, because its vc4_irq_reset() re-enables it, then flush job_done_work so that completions queued at teardown still release their jobs.  This issue was found by an in-house static analysis tool.",
  "published": "2026-10-26T15:16:48Z",
  "severity": "Moderate",
  "cvss": 5.7,
  "epss": 0.00168,
  "epssPercentile": 0.06234,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-99095",
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.113-1",
      "fix": "DEBIAN-CVE-2026-99095",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-99095",
      "released": "2026-10-27T21:14:52Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.2.11-1",
      "fix": "DEBIAN-CVE-2026-99095",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-99095",
      "released": "2026-10-27T21:14:52Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}