Executive brief
A memory leak vulnerability was identified in the Linux kernel's V3D graphics driver. This driver is responsible for managing Broadcom V3D GPU operations, commonly found in devices like the Raspberry Pi. An exploit could lead to a gradual depletion of system memory (a 'leak'), potentially causing system instability or a denial-of-service over time.
Technical details
A resource leak exists in the v3d_rewrite_csd_job_wg_counts_from_indirect() function within drivers/gpu/drm/v3d/v3d_sched.c. The function maps virtual address (vaddr) space for both indirect and workgroup buffers but fails to release these mappings if any workgroup count is zero, due to an early return statement that bypasses the cleanup logic. This results in a kernel memory leak of Buffer Object (BO) mappings. The issue was introduced in version 6.8 and has been resolved by ensuring the function jumps to the proper unmap labels before returning. Patches are available in stable branches 6.12.y, 6.18.y, 7.0.y, and mainline 7.1.
Affected products
- Linux Linux 6.8 to 6.12.93, 6.18.35, 7.0.12
Timeline
- 2026-06-02: other: Patch submitted by developer
- 2026-06-25: advisory: CVE published by kernel.org and NVD