← Chrome — 2026-W41
a7135d0a590288ba05b226058c928fb36a7f7eec [DCSI] Clear thread-local SharedContextState before recreating lost context
severity medium
class UAF
confidence 0.5
signal score 8.17
gpu/ipc/
Primitive: dangling thread-local SharedContextState pointer when recreating a directly-lost context
Triage note: GPU fix adds ClearForCurrentThread() before reset() and CHECK(!GetForCurrentThread()); comment 'Overwriting a live registration would leave a dangling thread-local pointer' (Bug 535630340). Real dangling-TLS fix but the guarded manifestation is a CHECK_NE in the destructor, so a live UAF is unproven from the diff.
Triage note: GPU fix adds ClearForCurrentThread() before reset() and CHECK(!GetForCurrentThread()); comment 'Overwriting a live registration would leave a dangling thread-local pointer' (Bug 535630340). Real dangling-TLS fix but the guarded manifestation is a CHECK_NE in the destructor, so a live UAF is unproven from the diff.
Structural signals: security_assert (+4.87), area:gpu/ipc/ (+2.0), surgical (+1.3)
Commit message
[DCSI] Clear thread-local SharedContextState before recreating lost context
Before / after
Loading diff…
On This Page