Linux Kernel V3D Driver NULL Pointer Dereference Vulnerability

A race condition vulnerability has been identified in the Linux kernel's V3D graphics driver. This issue arises from a conflict between the DRM scheduler workqueue and the IRQ execution thread. After a job is completed, the job pointer is set to NULL, indicating that the job is finished. However, this change creates a race condition: as the IRQ execution thread signals the completion of a job, a new job can be assigned to the same pointer. If the IRQ execution thread sets the pointer to NULL after a new job has been assigned, it can lead to a NULL pointer dereference. This dereference occurs when the completed job generates an interrupt, triggering a crash by accessing a NULL reference.

Impact

Exploitation of this vulnerability causes a kernel NULL pointer dereference, leading to a crash.