← Chrome — 2026-W40
65c300b6ec7ec0731cf3f4149be01cf0a47f2d51 [GPU Security] Improve GPU fence handle validation and lifetime.
severity medium
class InputValidation
confidence 0.55
signal score 12.76
gpu/command_buffer/
Primitive: invalid/null GpuFence handle: null-GLFence deref, bad FD to eglCreateSyncKHR, FD leak on failure
Triage note: Validates fence_fd.is_valid() and closes the released FD on failure; adds CHECK(gl_fence)/null-checks before dereferencing GLFence in BeginAccess. Hardens the GPU process against malformed fence handles, but the concrete bugs are a null-deref crash and FD leak, not a demonstrated memory-corruption primitive.
Triage note: Validates fence_fd.is_valid() and closes the released FD on failure; adds CHECK(gl_fence)/null-checks before dereferencing GLFence in BeginAccess. Hardens the GPU process against malformed fence handles, but the concrete bugs are a null-deref crash and FD leak, not a demonstrated memory-corruption primitive.
Structural signals: security_assert (+4.87), null_guard (+2.59), msg_medium (+2.0), area:gpu/command_buffer/ (+2.0), surgical (+1.3)
Commit message
[GPU Security] Improve GPU fence handle validation and lifetime.
Before / after
Loading diff…
On This Page