v3d ActiveJob UAF

Vulnerability analysis

When the V3D GPU driver submits a job for execution, it stores a reference to that job before attempting to create a synchronization fence. If fence creation fails, the driver returns an error but leaves the stored job reference in place, creating a dangling pointer. Other kernel code paths—such as the binning overflow memory handler—can then access this stale reference, potentially after the job object has already been freed, resulting in a use-after-free. The fix adds proper cleanup in all four job submission paths (binning, render, TFU, and CSD) so that the stored job reference is cleared whenever fence creation fails, with appropriate locking on the binning path to handle concurrent access. The vulnerability is reachable locally by any user with access to the V3D DRM render device node, which on typical Raspberry Pi and similar Broadcom SoC systems is available to non-root users through standard group permissions.