Vulnerability · CVE-2026-99095
CVE-2026-99095: drm/vc4: drain the hangcheck timer and works on V3D unbind
Published Oct 26, 2026 · catalog updated Oct 29, 2026 · Linux Linux Kernel
Last checked Nov 6, 2026. A connected source was read within the last 7 days.
Check if you run it
No confirmed exploitation is on record for CVE-2026-99095. EPSS is 0.17%. Act only if a listed version of Linux Linux Kernel is installed.
Gaps on this record
- No vendor fix or required action is stored. Compare the linked advisory before you change production.
Same product and reporting
- CVE-2026-100082 · Unknown
- CVE-2026-100080 · Unknown
- CVE-2026-100081 · Unknown
- CVE-2026-99270 · High
- CVE-2026-99262 · Unknown
- Severity
- Medium—
- Known exploitation
- Not in CISA/VulnCheck KEV
- EPSS
- 0.17%
- Remediation
- Advisory link
- Affected products
- Linux Kernel · Ubuntu:16.04:LTS linux-hwe-edge · Ubuntu:18.04:LTS linux-aws-5.0 · Ubuntu:18.04:LTS linux-aws-5.3 · Ubuntu:Pro:14.04:LTS linux-azure · Ubuntu:Pro:16.04:LTS linux-aws-hwe
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: drain the hangcheck timer and works on V3D unbind Nothing stops the hangcheck timer that submitted jobs arm, or the job_done_work that the render-done interrupt queues, at teardown: vc4_irq_disable() cancels only overflow_mem_work, and vc4_gem_destroy() runs from the drm-managed release, after vc4_v3d_unbind() has already uninstalled the V3D interrupt and cleared vc4->v3d. A timer still armed by then reads V3D registers through the NULL vc4->v3d pointer, and the late callbacks run on the vc4_dev embedding them after it has been freed. Drain them in vc4_v3d_unbind(): shut the timer down and cancel reset_work before the interrupt is taken down, because its vc4_irq_reset() re-enables it, then flush job_done_work so that completions queued at teardown still release their jobs. This issue was found by an in-house static analysis tool.
Are you affected?
Enter the version you run. The result uses only the ranges stored on this record.
The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.
- Linux Kernel4.5.0 → 6.6.160; 6.7.0 → 6.12.113; 6.13.0 → 6.18.57
- Ubuntu:16.04:LTS linux-hwe-edge4.8.0-28.30~16.04.1, 4.8.0-30.32~16.04.1, 4.8.0-32.34~16.04.1
- Ubuntu:18.04:LTS linux-aws-5.05.0.0-1021.24~18.04.1, 5.0.0-1022.25~18.04.1, 5.0.0-1023.26~18.04.1
- Ubuntu:18.04:LTS linux-aws-5.35.3.0-1016.17~18.04.1, 5.3.0-1017.18~18.04.1, 5.3.0-1019.21~18.04.1
- Ubuntu:Pro:14.04:LTS linux-azure4.15.0-1023.24~14.04.1, 4.15.0-1030.31~14.04.1, 4.15.0-1031.32~14.04.1
- Ubuntu:Pro:16.04:LTS linux-aws-hwe4.15.0-1030.31~16.04.1, 4.15.0-1031.33~16.04.1, 4.15.0-1032.34~16.04.1
- Ubuntu:Pro:16.04:LTS linux-azure4.11.0-1009.9, 4.11.0-1011.11, 4.11.0-1013.13
- Ubuntu:Pro:16.04:LTS linux-gcp4.10.0-1004.4, 4.10.0-1006.6, 4.10.0-1007.7
- Ubuntu:Pro:16.04:LTS linux-hwe4.8.0-36.36~16.04.1, 4.8.0-39.42~16.04.1, 4.8.0-41.44~16.04.1
- Ubuntu:Pro:16.04:LTS linux-oracle4.15.0-1007.9~16.04.1, 4.15.0-1008.10~16.04.1, 4.15.0-1009.11~16.04.1
- Ubuntu:Pro:18.04:LTS linux4.13.0-16.19, 4.13.0-17.20, 4.13.0-25.29
- Ubuntu:Pro:18.04:LTS linux-aws4.15.0-1001.1, 4.15.0-1003.3, 4.15.0-1005.5
- Ubuntu:Pro:18.04:LTS linux-aws-5.45.4.0-1018.18~18.04.1, 5.4.0-1020.20~18.04.2, 5.4.0-1022.22~18.04.1
- linux kernelversion unspecified
- package unmanagedversion unspecified
How to fix CVE-2026-99095
Upgrade
CVE-2026-99095 lists a fix boundary at 6.6.160. Compare the installed build with that boundary before you change production.
Version check
Seen in 4.5.0 → 6.6.160; 6.7.0 → 6.12.113; 6.13.0 → 6.18.57 · 15 other packages on the advisory
Advisory
Open the cve_org record and follow its fix.
Official advisories
What to do
Three questions, each answered from this record only. Confirm the vendor advisory before you patch.
Should you patch?
No confirmed exploitation is on record for CVE-2026-99095. EPSS is 0.17%. Act only if a listed version of Linux Linux Kernel is installed.
Which versions are affected?
Compare what you have installed with Kernel 4.5.0 → 6.6.160; 6.7.0 → 6.12.113; 6.13.0 → 6.18.57. Compare the installed version with the linked vendor advisory before you change production.
What should an analyst verify?
No weakness class is stored. EPSS 0.17%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.
Technology hubs
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 26, 2026 · Linux Kernel CVE
Detected
From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: drm/vc4: drain the hangcheck timer and works on V3D unbind Nothing stops the hangcheck timer that submitted jobs arm, or the job_done_work that the render-done interrupt queues, at teardown: vc4_irq_disable() cancels only overflow_mem_work, and vc4_gem_destroy() runs from the drm-ma
Oct 28, 2026 · OpenSSF OSV / OSV Scanner
Fix available
Kernel fixed in 6.6.160; Kernel fixed in 6.12.113; Kernel fixed in 6.18.57; Kernel fixed in 7.2.11
Oct 28, 2026 · OpenSSF OSV / OSV Scanner
Fix available
Kernel fixed in 6.6.160; 6.7.0
Oct 28, 2026 · OpenSSF OSV / OSV Scanner
Updated
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: drain the hangcheck timer and works on V3D unbind Nothing stops the hangcheck timer that submitted jobs arm, or the job_done_work that the render-done interrupt queues, at teardown: vc4_irq_disable() cancels only overflow_mem_work, and vc4_gem_destroy() runs from the drm-managed release, after vc4_v3d_unbind() has already
Oct 29, 2026 · OpenSSF OSV / OSV Scanner
Updated
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: drain the hangcheck timer and works on V3D unbind Nothing stops the hangcheck timer that submitted jobs arm, or the job_done_work that the render-done interrupt queues, at teardown: vc4_irq_disable() cancels only overflow_mem_work, and vc4_gem_destroy() runs from the drm-managed release, after vc4_v3d_unbind() has already
Sources
- CVE.orgVulnerability recordCVE-2026-99095
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-99095
30-day exploitation probability 0.17%
first.org - Linux Kernel CVEVendor advisoryCVE-2026-99095
From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: drm/vc4: drain the hangcheck timer and works on V3D unbind Nothing stops the hangcheck timer that submitted jobs arm, or the job_done_work that the render-done int
git.kernel.org - OpenSSF OSV / OSV ScannerPackage advisoryCVE-2026-99095
drm/vc4: drain the hangcheck timer and works on V3D unbind
osv.dev - OpenSSF OSV / OSV ScannerPackage advisoryUBUNTU-CVE-2026-99095osv.dev
- Snyk Vulnerability DatabasePackage advisorySNYK-UNMANAGED-TORVALDSLINUX-21735487
Buffer Overflow
security.snyk.io
References
Freshness
Last verified in this catalog Nov 6, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.
- FIRST EPSSOct 31, 2026
- Snyk Vulnerability DatabaseOct 29, 2026
- OpenSSF OSV / OSV ScannerOct 29, 2026
- OpenSSF OSV / OSV ScannerOct 28, 2026
- Linux Kernel CVEOct 28, 2026
- CVE.orgOct 27, 2026