CVE-2026-68233: Linux Kernel Race Condition Vulnerability

CVE-2026-68233 Overview

CVE-2026-68233 affects the Linux kernel's drm/vc4 graphics driver used on Broadcom VideoCore IV GPUs. The vulnerability resides in the buffer object (BO) cache teardown path in vc4_bo_cache_destroy(). A race condition exists between the cache timer callback and the deferred time_work handler, which can rearm the timer through vc4_bo_cache_free_old(). The existing teardown sequence deletes the timer and then cancels the work, but this fails to break the rearm cycle. The kernel maintainers resolved the issue by replacing del_timer_sync() semantics with timer_shutdown_sync(), preventing the timer from being rearmed before the final cancel_work_sync().

Critical Impact
A timer rearm race in the vc4 DRM driver teardown path can leave a scheduled timer active after cache destruction, leading to use-after-free conditions in kernel memory.

Affected Products

Linux kernel builds including the drm/vc4 driver (Broadcom VideoCore IV GPU support)
Raspberry Pi and other Broadcom SoC platforms using the vc4 DRM driver
Stable kernel branches referenced in commits 6273dd3, a38f272, and bac4c1a

Discovery Timeline

2026-08-10 - CVE-2026-68233 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68233

Vulnerability Analysis

The drm/vc4 driver maintains a cache of graphics buffer objects to reduce allocation overhead. A kernel timer periodically triggers cleanup of stale entries by scheduling time_work. The time_work handler calls vc4_bo_cache_free_old(), which can rearm the same timer if cached buffers remain.

During driver teardown, vc4_bo_cache_destroy() invoked del_timer_sync() followed by cancel_work_sync(). This ordering does not eliminate the rearm cycle. The cancelled work item may execute one final time and reschedule the timer. The timer subsequently queues new work after the cache structures are freed. Any callback executing against the destroyed cache can dereference freed memory.

Root Cause

The root cause is an improper teardown ordering that permits a timer-work rearm loop to survive destruction of the underlying data structures. This is a race condition [CWE-362] leading to potential use-after-free [CWE-416] in kernel context. The fix substitutes timer_shutdown_sync(), which marks the timer as terminated so it cannot be rearmed, ensuring cancel_work_sync() conclusively ends the cycle.

Attack Vector

Exploitation requires local access on a system running an affected kernel with the vc4 driver loaded. Triggering the race depends on driver unload, device removal, or module teardown paths coinciding with active BO cache activity. The vulnerability primarily affects reliability and could enable local denial of service through kernel memory corruption. Escalation potential depends on the state of freed cache structures at the time of the stale timer callback.

See the upstream fixes for technical details: Kernel Git Commit 6273dd3, Kernel Git Commit a38f272, and Kernel Git Commit bac4c1a.

Detection Methods for CVE-2026-68233

Indicators of Compromise

Kernel oops or panic messages referencing vc4_bo_cache_free_old, vc4_bo_cache_time_work, or timer callbacks after module unload
Unexpected general protection faults or use-after-free reports from KASAN builds involving the vc4 driver
System instability or crashes correlated with vc4 driver reload or device hotplug events

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) on test kernels to surface use-after-free access in vc4 teardown paths
Monitor kernel ring buffer (dmesg) for warnings involving timer_delete_sync, cancel_work_sync, or vc4-prefixed symbols
Track kernel versions across affected fleet inventories to identify unpatched Raspberry Pi and Broadcom-based hosts

Monitoring Recommendations

Centralize kernel logs from Linux endpoints to a SIEM or log platform and alert on repeated vc4-related crashes
Correlate driver reload events with subsequent kernel faults to identify systems experiencing the race
Baseline expected kernel versions for embedded and edge Linux devices to detect drift from patched builds

How to Mitigate CVE-2026-68233

Immediate Actions Required

Update affected Linux kernels to versions containing commits 6273dd3ffb54, a38f2724eb93, or bac4c1a9af69
Prioritize patching Raspberry Pi and Broadcom SoC devices running the vc4 DRM driver
Restrict local access on multi-user systems until patched kernels are deployed

Patch Information

The upstream fix replaces the timer teardown call with timer_shutdown_sync() in vc4_bo_cache_destroy(). This shuts down the timer permanently so vc4_bo_cache_free_old() cannot rearm it, and the subsequent cancel_work_sync() fully terminates the rearm cycle. Apply distribution kernel updates that incorporate the referenced stable-tree commits.

Workarounds

Avoid dynamic unload or reload of the vc4 kernel module on production systems until patched
Blacklist the vc4 driver on systems where the graphics functionality is not required
Limit CAP_SYS_MODULE and other privileges that permit driver teardown to trusted administrators only

bash

# Verify kernel version and check for the vc4 driver
uname -r
lsmod | grep vc4

# On systems where vc4 is not required, prevent loading
echo 'blacklist vc4' | sudo tee /etc/modprobe.d/blacklist-vc4.conf
sudo update-initramfs -u