Executive brief
A memory leak vulnerability was identified in the Linux kernel's video driver for Broadcom VC4 GPUs (commonly used in Raspberry Pi devices). When the GPU experiences a 'hang' or crash, the system fails to properly release memory used to store the error state. Over time, repeated GPU hangs could exhaust system memory, potentially leading to a system crash or denial of service.
Technical details
A memory leak exists in the drm/vc4 driver within the Linux kernel. The vulnerability is located in the vc4_free_hang_state() function in drivers/gpu/drm/vc4/vc4_gem.c. While the Buffer Object (BO) array is allocated using kzalloc() in vc4_save_hang_state(), the corresponding kfree() call was missing in the cleanup path. A local attacker or a malfunctioning application could trigger GPU hangs to repeatedly allocate this memory without release, eventually causing kernel memory exhaustion (CWE-401). The issue has been patched across multiple stable kernel branches including 6.6.y, 6.12.y, 6.18.y, and 6.19.y.
Affected products
- Linux Linux Kernel 4.5 to 6.6.136, 6.7 to 6.12.83, 6.13 to 6.18.24, 6.19 to 6.19.14, 7.0-rc1 to 7.0-rc7
Timeline
- 2026-03-30: other: Patch submitted by developer
- 2026-05-06: disclosed: CVE published
- 2026-06-01: patched: Final stable branch updates applied
References
- https://git.kernel.org/stable/c/0d3c014a84396a147705f523a8fd6fc873e76502
- https://git.kernel.org/stable/c/421cea4f71f7cf65abaae878562ee4aa2b684628
- https://git.kernel.org/stable/c/686bb2fce082f043db50db02b5de5c64ca4dc4c4
- https://git.kernel.org/stable/c/7235fc096ece53211bd2c0e958c65f9b802aeb98
- https://git.kernel.org/stable/c/9c092941fc1d00933bcb46ecac1cb930db3abf5d
- https://git.kernel.org/stable/c/a812008fe3a0aebb778d277b35717f64e23d0302
- https://git.kernel.org/stable/c/b8138567c4a80fd76a647849ebd4284996cf4b17