Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-98970EUVD-2026-108764GHSA-GVGC-QRVM-3584

drm/vc4: Free the BO cache size list on teardown

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 6.6.160, 6.12.113, 6.18.57, 7.2.11
None on Exploit-DB, Metasploit or GitHub

Summary

The Linux kernel's DRM driver for Broadcom VideoCore IV graphics (vc4, used on Raspberry Pi boards) is affected. When the driver is unbound, it fails to free a list used to track cached graphics buffers, causing a memory leak that can gradually consume kernel memory.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Read the original description

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Free the BO cache size list on teardown vc4_bo_cache_destroy() purges the cached BOs but never frees the size list, leaking it on every unbind.

Timeline

  1. CVE published
  2. First seen by cve.now
  3. Record last updated

Affected versions

  • Linux Linux

    Version range not reported

  • Linux Linux

    4.5

  • KernelLinux

    From 4.5.0 · fixed in 6.6.160; From 6.7.0 · fixed in 6.12.113; From 6.13.0 · fixed in 6.18.57; From 6.19.0 · fixed in 7.2.11

References 8

git.kernel.org