GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-74454 (GCVE-0-2026-74454)

Vulnerability from cvelistv5 – Published: 2026-08-15 12:26 – Updated: 2026-08-19 16:36
VLAI
Title
drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size vc4_overflow_mem_work() points BPOA at a 512KB slot inside the 16MB binner BO, but writes the size of the whole BO to BPOS. On every binner out-of-memory event the PTB is therefore authorized to write tile lists across all the other slots (which may hold the tile state, tile alloc and overflow memory of in-flight jobs) and, for any slot but the first, past the end of the binner BO into unrelated CMA memory. Since CMA pages are recycled into page cache and user allocations, this is arbitrary memory corruption by GPU DMA. In practice it shows up as GPU hangs with corrupted control list pointers, userspace heap corruption, a GPU that stays permanently wedged after the first hang, and occasional full system crashes, whenever a job overflows the initial binner slot. The bug dates back to the conversion from a dedicated overflow BO (where writing the full BO size was correct) to the slotted binner BO.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 553c942f8b2cbc7394b4d4fa2f848b23a8f07451 , < bb5656ae063f2711f56438cf2f1f5b613aea5f12 (git)
Affected: 553c942f8b2cbc7394b4d4fa2f848b23a8f07451 , < 2f2291a119e9a8b696ae8bb36e86b75d272ceaea (git)
Affected: 553c942f8b2cbc7394b4d4fa2f848b23a8f07451 , < 0badb30871004d34df87be33e853536f0b69885f (git)
Affected: 553c942f8b2cbc7394b4d4fa2f848b23a8f07451 , < 6cd5acf6f87c073622bd61e38fe99c47365cda9c (git)
Affected: 553c942f8b2cbc7394b4d4fa2f848b23a8f07451 , < 1e33ca7f44be64beed2735bb76b86eb65ba8c05b (git)
Affected: 553c942f8b2cbc7394b4d4fa2f848b23a8f07451 , < 6395789e4739aa5177bbec0fa0f07ccc38d249b0 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.13
Unaffected: 0 , < 4.13 (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.151 , ≤ 6.6.* (semver)
Unaffected: 6.12.103 , ≤ 6.12.* (semver)
Unaffected: 6.18.44 , ≤ 6.18.* (semver)
Unaffected: 7.1.8 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/vc4/vc4_irq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bb5656ae063f2711f56438cf2f1f5b613aea5f12",
              "status": "affected",
              "version": "553c942f8b2cbc7394b4d4fa2f848b23a8f07451",
              "versionType": "git"
            },
            {
              "lessThan": "2f2291a119e9a8b696ae8bb36e86b75d272ceaea",
              "status": "affected",
              "version": "553c942f8b2cbc7394b4d4fa2f848b23a8f07451",
              "versionType": "git"
            },
            {
              "lessThan": "0badb30871004d34df87be33e853536f0b69885f",
              "status": "affected",
              "version": "553c942f8b2cbc7394b4d4fa2f848b23a8f07451",
              "versionType": "git"
            },
            {
              "lessThan": "6cd5acf6f87c073622bd61e38fe99c47365cda9c",
              "status": "affected",
              "version": "553c942f8b2cbc7394b4d4fa2f848b23a8f07451",
              "versionType": "git"
            },
            {
              "lessThan": "1e33ca7f44be64beed2735bb76b86eb65ba8c05b",
              "status": "affected",
              "version": "553c942f8b2cbc7394b4d4fa2f848b23a8f07451",
              "versionType": "git"
            },
            {
              "lessThan": "6395789e4739aa5177bbec0fa0f07ccc38d249b0",
              "status": "affected",
              "version": "553c942f8b2cbc7394b4d4fa2f848b23a8f07451",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/vc4/vc4_irq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.13"
            },
            {
              "lessThan": "4.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size\n\nvc4_overflow_mem_work() points BPOA at a 512KB slot inside the 16MB\nbinner BO, but writes the size of the whole BO to BPOS. On every binner\nout-of-memory event the PTB is therefore authorized to write tile lists\nacross all the other slots (which may hold the tile state, tile alloc and\noverflow memory of in-flight jobs) and, for any slot but the first, past\nthe end of the binner BO into unrelated CMA memory.\n\nSince CMA pages are recycled into page cache and user allocations, this\nis arbitrary memory corruption by GPU DMA. In practice it shows up as GPU\nhangs with corrupted control list pointers, userspace heap corruption, a\nGPU that stays permanently wedged after the first hang, and occasional\nfull system crashes, whenever a job overflows the initial binner slot.\n\nThe bug dates back to the conversion from a dedicated overflow BO (where\nwriting the full BO size was correct) to the slotted binner BO."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires submitting crafted GPU jobs through the VC4 DRM render node via DRM_IOCTL_VC4_SUBMIT_CL; the bug is reached in vc4_overflow_mem_work() after hardware raises V3D_INT_OUTOMEM, which is a local ioctl/syscall path, not a network protocol.\nAC:L - An attacker with render-node access can reliably trigger binner out-of-memory by submitting dense geometry that exhausts the 32-byte initial per-bin allocation, and can run concurrent jobs to force non-zero overflow slots; no race or rare layout conditions beyond attacker-controlled GPU workloads are required.\nPR:L - VC4_SUBMIT_CL is permitted on DRM render nodes (DRM_RENDER_ALLOW, no DRM_AUTH) and vc4_open() performs no extra capability checks; on Raspberry Pi and similar VC4 deployments, unprivileged users in the render/video group routinely have /dev/dri/renderD* access to reach this path.\nUI:N - No victim interaction is required when the attacker is a local unprivileged user with render-node access who directly opens /dev/dri/renderD* and submits a malicious binning command list designed to overflow the initial binner slot.\nS:U - The flaw causes GPU DMA to corrupt CMA memory used by the kernel and userspace, enabling standard local privilege escalation; it does not cross a VM, IOMMU, or hypervisor security boundary and stays within the kernel\u0027s security authority.\nC:H - On OUTOMEM, the driver programs BPOA to a 512KB slot but BPOS to the full 16MB BO, authorizing the PTB to DMA-write far beyond the slot into adjacent in-flight job data and unrelated CMA pages recycled into page cache and user allocations, enabling arbitrary kernel memory disclosure.\nI:H - The oversized BPOS grants the GPU PTB an out-of-bounds DMA write primitive across other binner slots and past the 16MB BO boundary into unrelated CMA memory, corrupting kernel structures and userspace heaps in ways suitable for arbitrary code execution and privilege escalation.\nA:H - The commit reports that triggering binner overflow causes GPU hangs with corrupted control-list pointers, permanently wedged GPUs after the first hang, userspace heap corruption, and occasional full system crashes, satisfying high availability impact from repeatable kernel/GPU failure."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:36:46.319Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bb5656ae063f2711f56438cf2f1f5b613aea5f12"
        },
        {
          "url": "https://git.kernel.org/stable/c/2f2291a119e9a8b696ae8bb36e86b75d272ceaea"
        },
        {
          "url": "https://git.kernel.org/stable/c/0badb30871004d34df87be33e853536f0b69885f"
        },
        {
          "url": "https://git.kernel.org/stable/c/6cd5acf6f87c073622bd61e38fe99c47365cda9c"
        },
        {
          "url": "https://git.kernel.org/stable/c/1e33ca7f44be64beed2735bb76b86eb65ba8c05b"
        },
        {
          "url": "https://git.kernel.org/stable/c/6395789e4739aa5177bbec0fa0f07ccc38d249b0"
        }
      ],
      "title": "drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74454",
    "datePublished": "2026-08-15T12:26:57.565Z",
    "dateReserved": "2026-08-15T05:44:03.900Z",
    "dateUpdated": "2026-08-19T16:36:46.319Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74454",
      "date": "2026-09-10",
      "epss": "0.00129",
      "percentile": "0.029"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-11T01:52:03.000Z",
      "cve": "CVE-2026-74454",
      "id": "msrc_CVE-2026-74454",
      "initial_release_date": "2026-08-23T14:42:27.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74454.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74454\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T13:17:50.003\",\"lastModified\":\"2026-08-19T17:21:02.113\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size\\n\\nvc4_overflow_mem_work() points BPOA at a 512KB slot inside the 16MB\\nbinner BO, but writes the size of the whole BO to BPOS. On every binner\\nout-of-memory event the PTB is therefore authorized to write tile lists\\nacross all the other slots (which may hold the tile state, tile alloc and\\noverflow memory of in-flight jobs) and, for any slot but the first, past\\nthe end of the binner BO into unrelated CMA memory.\\n\\nSince CMA pages are recycled into page cache and user allocations, this\\nis arbitrary memory corruption by GPU DMA. In practice it shows up as GPU\\nhangs with corrupted control list pointers, userspace heap corruption, a\\nGPU that stays permanently wedged after the first hang, and occasional\\nfull system crashes, whenever a job overflows the initial binner slot.\\n\\nThe bug dates back to the conversion from a dedicated overflow BO (where\\nwriting the full BO size was correct) to the slotted binner BO.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/vc4/vc4_irq.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"553c942f8b2cbc7394b4d4fa2f848b23a8f07451\",\"lessThan\":\"bb5656ae063f2711f56438cf2f1f5b613aea5f12\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"553c942f8b2cbc7394b4d4fa2f848b23a8f07451\",\"lessThan\":\"2f2291a119e9a8b696ae8bb36e86b75d272ceaea\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"553c942f8b2cbc7394b4d4fa2f848b23a8f07451\",\"lessThan\":\"0badb30871004d34df87be33e853536f0b69885f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"553c942f8b2cbc7394b4d4fa2f848b23a8f07451\",\"lessThan\":\"6cd5acf6f87c073622bd61e38fe99c47365cda9c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"553c942f8b2cbc7394b4d4fa2f848b23a8f07451\",\"lessThan\":\"1e33ca7f44be64beed2735bb76b86eb65ba8c05b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"553c942f8b2cbc7394b4d4fa2f848b23a8f07451\",\"lessThan\":\"6395789e4739aa5177bbec0fa0f07ccc38d249b0\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/vc4/vc4_irq.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.13\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.13\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.183\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.151\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.103\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.44\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.8\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0badb30871004d34df87be33e853536f0b69885f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/1e33ca7f44be64beed2735bb76b86eb65ba8c05b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/2f2291a119e9a8b696ae8bb36e86b75d272ceaea\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6395789e4739aa5177bbec0fa0f07ccc38d249b0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6cd5acf6f87c073622bd61e38fe99c47365cda9c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bb5656ae063f2711f56438cf2f1f5b613aea5f12\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-21T09:45:17+00:00",
      "cve": "CVE-2026-74454",
      "id": "CVE-2026-74454",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74454.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-09T00:00:45Z",
      "cve": "CVE-2026-74454",
      "id": "CVE-2026-74454",
      "initial_release_date": "2026-08-27T16:51:26Z",
      "product_status:first_fixed": "205",
      "product_status:known_affected": "263",
      "product_status:known_not_affected": "82",
      "product_status:recommended": "11",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74454",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74454.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.