Executive brief
A vulnerability in the Linux kernel's graphics subsystem (DRM) could allow a local user to crash the system. By repeatedly requesting the creation of large data objects without proper resource tracking, an unprivileged user can exhaust the server's memory. This leads to a 'denial of service' where the system becomes unresponsive or shuts down critical processes to recover memory.
Technical details
A vulnerability exists in the Direct Rendering Manager (DRM) subsystem of the Linux kernel due to missing memory cgroup (memcg) accounting. The DRM_IOCTL_MODE_CREATEPROPBLOB ioctl allows userspace to allocate arbitrary-sized property blobs. Because these allocations were not marked with the GFP_KERNEL_ACCOUNT flag, they were not charged to the calling process's memory cgroup. A local, unprivileged attacker can exploit this to bypass cgroup memory limits, leading to uncontrolled kernel memory growth and a system-wide Out-of-Memory (OOM) state. The issue has been resolved by updating drm_property_create_blob to use GFP_KERNEL_ACCOUNT during allocation.
Affected products
- Linux Linux kernel All versions prior to the 2026-03-04 patches
Timeline
- 2026-01-14: other: Patch authored
- 2026-03-04: patched: Patches committed to various stable branches
- 2026-05-08: disclosed: CVE published
References
- https://git.kernel.org/stable/c/26b4309a3ab82a0697751cde52eb336c29c19035
- https://git.kernel.org/stable/c/405fd652d8fedff219a8f48daf8f20e881e303ab
- https://git.kernel.org/stable/c/815fa29cab3c67bebb9d0b5f41145cdd3a14d04d
- https://git.kernel.org/stable/c/866e0c1a9e7244d58ed74853cb22b81e1900cfdd
- https://git.kernel.org/stable/c/8e1664b9ee43608eb973d357ae5d858d30cbc9ca
- https://git.kernel.org/stable/c/b6117210ed349356f8e6027ff020b4d620bca42b
- https://git.kernel.org/stable/c/bbfaa5761f589a81031b493cb01275a990d6fb25