Executive brief
The Linux kernel's host1x GPU driver has a memory leak in its buffer object caching mechanism. Cached GPU buffer mappings were never freed from memory because of a circular reference between the cache and the buffer object itself, causing system memory to gradually be exhausted over time.
Technical details
The vulnerability is a circular reference in the host1x buffer object (BO) cache. When a buffer object was pinned with caching enabled, the cache held a strong reference to the BO, and the BO held references to cached mappings. The only path to remove cached mappings was through buffer object deallocation, but the cached references prevented that deallocation. The fix resolves this by converting the cache to hold weak references to buffer objects instead of strong references, allowing them to be freed even when cached. The vulnerable code path affects Tegra DRM GEM buffers which are the only ones currently eligible for caching.
Affected products
- Linux Linux kernel 5.0 and later (affected by cache feature introduced in 1f39b1dfa53c)
Timeline
- 2026-08-15: disclosed
- 2026-05-15: patched: Fix committed upstream
- 2026-07-24: other: Backported to stable tree