CVE-2026-46314

In the Linux kernel, the following vulnerability has been resolved:

drm/v3d: Reject empty multisync extension to prevent infinite loop

v3dgetextensions() walks a userspace-provided singly-linked list of ioctl extensions without any bound on the chain length. A local user can craft a self-referential extension (ext->next == &ext) with zero insynccount and outsynccount, which bypasses the existing duplicate- extension guard:

if (se->in_sync_count || se->out_sync_count)
        return -EINVAL;

The guard never fires because v3dgetmultisyncpostdeps() returns immediately when count is zero, leaving both fields at zero on every iteration. The result is an infinite loop in kernel context, blocking the calling thread and pegging a CPU core indefinitely.

Fix this by rejecting a multisync extension where both insynccount and outsynccount are zero in v3dgetmultisyncsubmitdeps(). An empty multisync carries no synchronization information and serves no useful purpose, so returning -EINVAL for such an extension is the correct defense against this attack vector.