Executive brief
A memory leak vulnerability was identified in the Linux kernel's Broadcom VC4 graphics driver. When the system attempts to save the state of the graphics processor after a crash or 'hang,' certain error conditions could cause the system to fail to release allocated memory. Over time, repeated occurrences could lead to memory exhaustion, potentially causing system instability or a denial-of-service.
Technical details
A memory leak vulnerability exists in the vc4_save_hang_state() function within the Linux kernel's DRM driver for Broadcom VC4 GPUs (drivers/gpu/drm/vc4/vc4_gem.c). The root cause is an improper error handling path where the function returns early upon failing to find active jobs or failing to allocate buffer objects, without invoking kfree() on the previously allocated 'kernel_state' structure. A local attacker could potentially trigger this leak repeatedly to exhaust system memory (CWE-401), leading to a denial-of-service. The issue has been resolved by consolidating error paths to ensure proper memory deallocation. Patches are available for multiple stable kernel branches including 6.6.y, 6.12.y, 6.18.y, and 6.19.y.
Affected products
- Linux Linux Kernel 4.5 to 6.6.136, 6.7 to 6.12.83, 6.13 to 6.18.24, 6.19 to 6.19.14, 7.0-rc1 to 7.0-rc7
Timeline
- 2026-05-06: disclosed
- 2026-05-06: advisory
References
- https://git.kernel.org/stable/c/259e2bba3fd7005c62cbd42365a48b3221b244e3
- https://git.kernel.org/stable/c/3eb7dd55021d0f4308fbea0bea21d2118984d8e7
- https://git.kernel.org/stable/c/9487daa18e627ac6b5ed5911be79f23362554b70
- https://git.kernel.org/stable/c/9525d169e5fd481538cf8c663cc5839e54f2e481
- https://git.kernel.org/stable/c/c197def3834cbee3fd824ce4c57d08cb24e18955
- https://git.kernel.org/stable/c/d8fdd6adc07b78ad3e9ee0004876d90cb59ca941
- https://git.kernel.org/stable/c/dd5c49787a32da96a2b154427eb17cbf12a83c28