Executive brief
The Linux kernel's Direct Rendering Manager (DRM) synchronization object subsystem contains a memory leak in the drm_syncobj_find_fence() function. When invalid flags are passed, the function returns early without properly releasing a reference to a synchronization object, causing kernel memory to accumulate and eventually exhaust system resources.
Technical details
The vulnerability is a reference counting bug in the DRM synchronization object subsystem. The function drm_syncobj_find() acquires a reference to a synchronization object, but a previous commit (18226ba52159) added an early return path when invalid flags are detected without dropping the reference, violating the reference-counting contract. The fix changes the early return to a goto statement that reaches a common cleanup path (marked as "out") that properly releases the reference. This is a local code path issue affecting only in-kernel error handling, with no network attack vector.
Affected products
- Linux Linux kernel 5.0 and later (affected by commit 18226ba52159)
Timeline
- 2026-08-15: disclosed
- 2026-05-07: patched