CVE-2026-93192

In the Linux kernel, the following vulnerability has been resolved:

drm/v3d: Clear queue->active_job when v3d_fence_create() fails

The run_job() callbacks for BIN, RENDER, TFU and CSD assign the incoming

job to queue->active_job before calling v3d_fence_create(). If

v3d_fence_create() fails, the callback returns NULL without clearing

active_job, leaving a dangling pointer.

Create a failure path in all run_job() callbacks that clears the active

job before returning NULL. The BIN path takes queue->queue_lock around the

clear as it races against v3d_overflow_mem_work(); RENDER, TFU and CSD

paths have no concurrent reader, so the clear is lock-free.