CVE-2026-46247
Description
A bug in the Linux kernel's GFX3D clock rate determination can cause a crash due to an incorrect parent map.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
A bug in the Linux kernel's GFX3D clock rate determination can cause a crash due to an incorrect parent map.
Vulnerability
A flaw exists in the Linux kernel's clock handling for the QCOM GFX3D component. After commit d228ece36345, the determine_rate() function crashes because the provided parent map does not supply the expected best_parent_hw clock, a behavior that was previously ignored by the round_rate path. This issue affects versions of the kernel after the mentioned commit.
Exploitation
Exploitation of this vulnerability requires the kernel to reach the code path responsible for determining the GFX3D clock rate. An attacker would need to trigger a scenario that invokes the devfreq_update_target function, which eventually calls clk_gfx3d_determine_rate. This could potentially be achieved by manipulating device frequency settings.
Impact
Successful exploitation of this vulnerability leads to a crash in the kernel's clock rate determination logic, specifically affecting the GFX3D clock. This crash can result in a denial-of-service condition, making the affected system unstable or unresponsive. The exact privilege level required to trigger this is not specified, but it relates to device frequency management.
Mitigation
This vulnerability has been resolved by adding the parent to the parent request map in the clk: qcom: gfx3d driver. The fix is available in the Linux kernel. Specific patched versions and release dates are not detailed in the provided references, but the commit reference [1] indicates the resolution. No workarounds are mentioned, and the vulnerability is not listed as part of the KEV catalog.
AI Insight generated on Jun 3, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
1Patches
128aa972eba1f2clk: qcom: gfx3d: add parent to parent request map
1 file changed · +1 −1
drivers/clk/qcom/clk-rcg2.c+1 −1 modifieddiff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c index 2838d4cb2d58e..d0a5847f91114 100644 --- a/drivers/clk/qcom/clk-rcg2.c +++ b/drivers/clk/qcom/clk-rcg2.c @@ -1264,6 +1264,7 @@ static int clk_gfx3d_determine_rate(struct clk_hw *hw, if (req->max_rate < parent_req.max_rate) parent_req.max_rate = req->max_rate; + parent_req.best_parent_hw = req->best_parent_hw; ret = __clk_determine_rate(req->best_parent_hw, &parent_req); if (ret) return ret; -- cgit 1.3-korg
2583cb925ca1clk: qcom: gfx3d: add parent to parent request map
1 file changed · +1 −1
drivers/clk/qcom/clk-rcg2.c+1 −1 modifieddiff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c index 2838d4cb2d58e..d0a5847f91114 100644 --- a/drivers/clk/qcom/clk-rcg2.c +++ b/drivers/clk/qcom/clk-rcg2.c @@ -1264,6 +1264,7 @@ static int clk_gfx3d_determine_rate(struct clk_hw *hw, if (req->max_rate < parent_req.max_rate) parent_req.max_rate = req->max_rate; + parent_req.best_parent_hw = req->best_parent_hw; ret = __clk_determine_rate(req->best_parent_hw, &parent_req); if (ret) return ret; -- cgit 1.3-korg
82cfe5292b11clk: qcom: gfx3d: add parent to parent request map
1 file changed · +1 −1
drivers/clk/qcom/clk-rcg2.c+1 −1 modifieddiff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c index 0e26f4f0bdbae..3dc9356b711d5 100644 --- a/drivers/clk/qcom/clk-rcg2.c +++ b/drivers/clk/qcom/clk-rcg2.c @@ -916,6 +916,7 @@ static int clk_gfx3d_determine_rate(struct clk_hw *hw, if (req->max_rate < parent_req.max_rate) parent_req.max_rate = req->max_rate; + parent_req.best_parent_hw = req->best_parent_hw; ret = __clk_determine_rate(req->best_parent_hw, &parent_req); if (ret) return ret; -- cgit 1.3-korg
547ae2f17349clk: qcom: gfx3d: add parent to parent request map
1 file changed · +1 −1
drivers/clk/qcom/clk-rcg2.c+1 −1 modifieddiff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c index 658d2ee7aacff..20bb72565f0ed 100644 --- a/drivers/clk/qcom/clk-rcg2.c +++ b/drivers/clk/qcom/clk-rcg2.c @@ -918,6 +918,7 @@ static int clk_gfx3d_determine_rate(struct clk_hw *hw, if (req->max_rate < parent_req.max_rate) parent_req.max_rate = req->max_rate; + parent_req.best_parent_hw = req->best_parent_hw; ret = __clk_determine_rate(req->best_parent_hw, &parent_req); if (ret) return ret; -- cgit 1.3-korg
56360aa4ddd7clk: qcom: gfx3d: add parent to parent request map
1 file changed · +1 −1
drivers/clk/qcom/clk-rcg2.c+1 −1 modifieddiff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c index 005c1da75dafc..6aa9dcdabffde 100644 --- a/drivers/clk/qcom/clk-rcg2.c +++ b/drivers/clk/qcom/clk-rcg2.c @@ -1084,6 +1084,7 @@ static int clk_gfx3d_determine_rate(struct clk_hw *hw, if (req->max_rate < parent_req.max_rate) parent_req.max_rate = req->max_rate; + parent_req.best_parent_hw = req->best_parent_hw; ret = __clk_determine_rate(req->best_parent_hw, &parent_req); if (ret) return ret; -- cgit 1.3-korg
aed53da569fbclk: qcom: gfx3d: add parent to parent request map
1 file changed · +1 −1
drivers/clk/qcom/clk-rcg2.c+1 −1 modifieddiff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c index 2838d4cb2d58e..d0a5847f91114 100644 --- a/drivers/clk/qcom/clk-rcg2.c +++ b/drivers/clk/qcom/clk-rcg2.c @@ -1264,6 +1264,7 @@ static int clk_gfx3d_determine_rate(struct clk_hw *hw, if (req->max_rate < parent_req.max_rate) parent_req.max_rate = req->max_rate; + parent_req.best_parent_hw = req->best_parent_hw; ret = __clk_determine_rate(req->best_parent_hw, &parent_req); if (ret) return ret; -- cgit 1.3-korg
8aa972eba1f2clk: qcom: gfx3d: add parent to parent request map
1 file changed · +1 −1
drivers/clk/qcom/clk-rcg2.c+1 −1 modifieddiff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c index 2838d4cb2d58e..d0a5847f91114 100644 --- a/drivers/clk/qcom/clk-rcg2.c +++ b/drivers/clk/qcom/clk-rcg2.c @@ -1264,6 +1264,7 @@ static int clk_gfx3d_determine_rate(struct clk_hw *hw, if (req->max_rate < parent_req.max_rate) parent_req.max_rate = req->max_rate; + parent_req.best_parent_hw = req->best_parent_hw; ret = __clk_determine_rate(req->best_parent_hw, &parent_req); if (ret) return ret; -- cgit 1.3-korg
aed53da569fbclk: qcom: gfx3d: add parent to parent request map
1 file changed · +1 −1
drivers/clk/qcom/clk-rcg2.c+1 −1 modifieddiff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c index 2838d4cb2d58e..d0a5847f91114 100644 --- a/drivers/clk/qcom/clk-rcg2.c +++ b/drivers/clk/qcom/clk-rcg2.c @@ -1264,6 +1264,7 @@ static int clk_gfx3d_determine_rate(struct clk_hw *hw, if (req->max_rate < parent_req.max_rate) parent_req.max_rate = req->max_rate; + parent_req.best_parent_hw = req->best_parent_hw; ret = __clk_determine_rate(req->best_parent_hw, &parent_req); if (ret) return ret; -- cgit 1.3-korg
2583cb925ca1clk: qcom: gfx3d: add parent to parent request map
1 file changed · +1 −1
drivers/clk/qcom/clk-rcg2.c+1 −1 modifieddiff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c index 2838d4cb2d58e..d0a5847f91114 100644 --- a/drivers/clk/qcom/clk-rcg2.c +++ b/drivers/clk/qcom/clk-rcg2.c @@ -1264,6 +1264,7 @@ static int clk_gfx3d_determine_rate(struct clk_hw *hw, if (req->max_rate < parent_req.max_rate) parent_req.max_rate = req->max_rate; + parent_req.best_parent_hw = req->best_parent_hw; ret = __clk_determine_rate(req->best_parent_hw, &parent_req); if (ret) return ret; -- cgit 1.3-korg
547ae2f17349clk: qcom: gfx3d: add parent to parent request map
1 file changed · +1 −1
drivers/clk/qcom/clk-rcg2.c+1 −1 modifieddiff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c index 658d2ee7aacff..20bb72565f0ed 100644 --- a/drivers/clk/qcom/clk-rcg2.c +++ b/drivers/clk/qcom/clk-rcg2.c @@ -918,6 +918,7 @@ static int clk_gfx3d_determine_rate(struct clk_hw *hw, if (req->max_rate < parent_req.max_rate) parent_req.max_rate = req->max_rate; + parent_req.best_parent_hw = req->best_parent_hw; ret = __clk_determine_rate(req->best_parent_hw, &parent_req); if (ret) return ret; -- cgit 1.3-korg
56360aa4ddd7clk: qcom: gfx3d: add parent to parent request map
1 file changed · +1 −1
drivers/clk/qcom/clk-rcg2.c+1 −1 modifieddiff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c index 005c1da75dafc..6aa9dcdabffde 100644 --- a/drivers/clk/qcom/clk-rcg2.c +++ b/drivers/clk/qcom/clk-rcg2.c @@ -1084,6 +1084,7 @@ static int clk_gfx3d_determine_rate(struct clk_hw *hw, if (req->max_rate < parent_req.max_rate) parent_req.max_rate = req->max_rate; + parent_req.best_parent_hw = req->best_parent_hw; ret = __clk_determine_rate(req->best_parent_hw, &parent_req); if (ret) return ret; -- cgit 1.3-korg
82cfe5292b11clk: qcom: gfx3d: add parent to parent request map
1 file changed · +1 −1
drivers/clk/qcom/clk-rcg2.c+1 −1 modifieddiff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c index 0e26f4f0bdbae..3dc9356b711d5 100644 --- a/drivers/clk/qcom/clk-rcg2.c +++ b/drivers/clk/qcom/clk-rcg2.c @@ -916,6 +916,7 @@ static int clk_gfx3d_determine_rate(struct clk_hw *hw, if (req->max_rate < parent_req.max_rate) parent_req.max_rate = req->max_rate; + parent_req.best_parent_hw = req->best_parent_hw; ret = __clk_determine_rate(req->best_parent_hw, &parent_req); if (ret) return ret; -- cgit 1.3-korg
Vulnerability mechanics
No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.
References
6- git.kernel.org/stable/c/2583cb925ca1ce450aa5d74a05a67448db970193nvd
- git.kernel.org/stable/c/547ae2f17349c7586953af5ef50de43ef3f65e9envd
- git.kernel.org/stable/c/56360aa4ddd736fc19e6d0b0206c5e437e0d6ff8nvd
- git.kernel.org/stable/c/82cfe5292b11deb1dc33822f67f73cfbe8eafe25nvd
- git.kernel.org/stable/c/8aa972eba1f29068d13bec716d33abca30fb3f2anvd
- git.kernel.org/stable/c/aed53da569fb96eec09b4817b1953bcc2e467eeanvd
News mentions
0No linked articles in our index yet.