CVE-2026-74454

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74454", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.900Z", "datePublished": "2026-08-15T12:26:57.565Z", "dateUpdated": "2026-08-19T16:36:46.319Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-19T16:36:46.319Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size\n\nvc4_overflow_mem_work() points BPOA at a 512KB slot inside the 16MB\nbinner BO, but writes the size of the whole BO to BPOS. On every binner\nout-of-memory event the PTB is therefore authorized to write tile lists\nacross all the other slots (which may hold the tile state, tile alloc and\noverflow memory of in-flight jobs) and, for any slot but the first, past\nthe end of the binner BO into unrelated CMA memory.\n\nSince CMA pages are recycled into page cache and user allocations, this\nis arbitrary memory corruption by GPU DMA. In practice it shows up as GPU\nhangs with corrupted control list pointers, userspace heap corruption, a\nGPU that stays permanently wedged after the first hang, and occasional\nfull system crashes, whenever a job overflows the initial binner slot.\n\nThe bug dates back to the conversion from a dedicated overflow BO (where\nwriting the full BO size was correct) to the slotted binner BO."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires submitting crafted GPU jobs through the VC4 DRM render node via DRM_IOCTL_VC4_SUBMIT_CL; the bug is reached in vc4_overflow_mem_work() after hardware raises V3D_INT_OUTOMEM, which is a local ioctl/syscall path, not a network protocol.\nAC:L - An attacker with render-node access can reliably trigger binner out-of-memory by submitting dense geometry that exhausts the 32-byte initial per-bin allocation, and can run concurrent jobs to force non-zero overflow slots; no race or rare layout conditions beyond attacker-controlled GPU workloads are required.\nPR:L - VC4_SUBMIT_CL is permitted on DRM render nodes (DRM_RENDER_ALLOW, no DRM_AUTH) and vc4_open() performs no extra capability checks; on Raspberry Pi and similar VC4 deployments, unprivileged users in the render/video group routinely have /dev/dri/renderD* access to reach this path.\nUI:N - No victim interaction is required when the attacker is a local unprivileged user with render-node access who directly opens /dev/dri/renderD* and submits a malicious binning command list designed to overflow the initial binner slot.\nS:U - The flaw causes GPU DMA to corrupt CMA memory used by the kernel and userspace, enabling standard local privilege escalation; it does not cross a VM, IOMMU, or hypervisor security boundary and stays within the kernel's security authority.\nC:H - On OUTOMEM, the driver programs BPOA to a 512KB slot but BPOS to the full 16MB BO, authorizing the PTB to DMA-write far beyond the slot into adjacent in-flight job data and unrelated CMA pages recycled into page cache and user allocations, enabling arbitrary kernel memory disclosure.\nI:H - The oversized BPOS grants the GPU PTB an out-of-bounds DMA write primitive across other binner slots and past the 16MB BO boundary into unrelated CMA memory, corrupting kernel structures and userspace heaps in ways suitable for arbitrary code execution and privilege escalation.\nA:H - The commit reports that triggering binner overflow causes GPU hangs with corrupted control-list pointers, permanently wedged GPUs after the first hang, userspace heap corruption, and occasional full system crashes, satisfying high availability impact from repeatable kernel/GPU failure."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/vc4/vc4_irq.c"], "versions": [{"version": "553c942f8b2cbc7394b4d4fa2f848b23a8f07451", "lessThan": "bb5656ae063f2711f56438cf2f1f5b613aea5f12", "status": "affected", "versionType": "git"}, {"version": "553c942f8b2cbc7394b4d4fa2f848b23a8f07451", "lessThan": "2f2291a119e9a8b696ae8bb36e86b75d272ceaea", "status": "affected", "versionType": "git"}, {"version": "553c942f8b2cbc7394b4d4fa2f848b23a8f07451", "lessThan": "0badb30871004d34df87be33e853536f0b69885f", "status": "affected", "versionType": "git"}, {"version": "553c942f8b2cbc7394b4d4fa2f848b23a8f07451", "lessThan": "6cd5acf6f87c073622bd61e38fe99c47365cda9c", "status": "affected", "versionType": "git"}, {"version": "553c942f8b2cbc7394b4d4fa2f848b23a8f07451", "lessThan": "1e33ca7f44be64beed2735bb76b86eb65ba8c05b", "status": "affected", "versionType": "git"}, {"version": "553c942f8b2cbc7394b4d4fa2f848b23a8f07451", "lessThan": "6395789e4739aa5177bbec0fa0f07ccc38d249b0", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/vc4/vc4_irq.c"], "versions": [{"version": "4.13", "status": "affected"}, {"version": "0", "lessThan": "4.13", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.151", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.103", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.44", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.8", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "6.6.151"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "6.12.103"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "6.18.44"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "7.1.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.13", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/bb5656ae063f2711f56438cf2f1f5b613aea5f12"}, {"url": "https://git.kernel.org/stable/c/2f2291a119e9a8b696ae8bb36e86b75d272ceaea"}, {"url": "https://git.kernel.org/stable/c/0badb30871004d34df87be33e853536f0b69885f"}, {"url": "https://git.kernel.org/stable/c/6cd5acf6f87c073622bd61e38fe99c47365cda9c"}, {"url": "https://git.kernel.org/stable/c/1e33ca7f44be64beed2735bb76b86eb65ba8c05b"}, {"url": "https://git.kernel.org/stable/c/6395789e4739aa5177bbec0fa0f07ccc38d249b0"}], "title": "drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/vc4/vc4_irq.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "bb5656ae063f2711f56438cf2f1f5b613aea5f12", "status": "affected", "version": "553c942f8b2cbc7394b4d4fa2f848b23a8f07451", "versionType": "git"}, {"lessThan": "2f2291a119e9a8b696ae8bb36e86b75d272ceaea", "status": "affected", "version": "553c942f8b2cbc7394b4d4fa2f848b23a8f07451", "versionType": "git"}, {"lessThan": "0badb30871004d34df87be33e853536f0b69885f", "status": "affected", "version": "553c942f8b2cbc7394b4d4fa2f848b23a8f07451", "versionType": "git"}, {"lessThan": "6cd5acf6f87c073622bd61e38fe99c47365cda9c", "status": "affected", "version": "553c942f8b2cbc7394b4d4fa2f848b23a8f07451", "versionType": "git"}, {"lessThan": "1e33ca7f44be64beed2735bb76b86eb65ba8c05b", "status": "affected", "version": "553c942f8b2cbc7394b4d4fa2f848b23a8f07451", "versionType": "git"}, {"lessThan": "6395789e4739aa5177bbec0fa0f07ccc38d249b0", "status": "affected", "version": "553c942f8b2cbc7394b4d4fa2f848b23a8f07451", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/vc4/vc4_irq.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.13"}, {"lessThan": "4.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.183", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.151", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.103", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.44", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size\n\nvc4_overflow_mem_work() points BPOA at a 512KB slot inside the 16MB\nbinner BO, but writes the size of the whole BO to BPOS. On every binner\nout-of-memory event the PTB is therefore authorized to write tile lists\nacross all the other slots (which may hold the tile state, tile alloc and\noverflow memory of in-flight jobs) and, for any slot but the first, past\nthe end of the binner BO into unrelated CMA memory.\n\nSince CMA pages are recycled into page cache and user allocations, this\nis arbitrary memory corruption by GPU DMA. In practice it shows up as GPU\nhangs with corrupted control list pointers, userspace heap corruption, a\nGPU that stays permanently wedged after the first hang, and occasional\nfull system crashes, whenever a job overflows the initial binner slot.\n\nThe bug dates back to the conversion from a dedicated overflow BO (where\nwriting the full BO size was correct) to the slotted binner BO."}], "id": "CVE-2026-74454", "lastModified": "2026-08-19T17:21:02.113", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-15T13:17:50.003", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0badb30871004d34df87be33e853536f0b69885f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1e33ca7f44be64beed2735bb76b86eb65ba8c05b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2f2291a119e9a8b696ae8bb36e86b75d272ceaea"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6395789e4739aa5177bbec0fa0f07ccc38d249b0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6cd5acf6f87c073622bd61e38fe99c47365cda9c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bb5656ae063f2711f56438cf2f1f5b613aea5f12"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size", "id": "2516984", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516984"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size\nvc4_overflow_mem_work() points BPOA at a 512KB slot inside the 16MB\nbinner BO, but writes the size of the whole BO to BPOS. On every binner\nout-of-memory event the PTB is therefore authorized to write tile lists\nacross all the other slots (which may hold the tile state, tile alloc and\noverflow memory of in-flight jobs) and, for any slot but the first, past\nthe end of the binner BO into unrelated CMA memory.\nSince CMA pages are recycled into page cache and user allocations, this\nis arbitrary memory corruption by GPU DMA. In practice it shows up as GPU\nhangs with corrupted control list pointers, userspace heap corruption, a\nGPU that stays permanently wedged after the first hang, and occasional\nfull system crashes, whenever a job overflows the initial binner slot.\nThe bug dates back to the conversion from a dedicated overflow BO (where\nwriting the full BO size was correct) to the slotted binner BO.", "A flaw was found in the Linux kernel's drm/vc4 component. An out-of-bounds write vulnerability exists where the graphics processing unit (GPU) driver incorrectly calculates memory allocation sizes. This allows the GPU to write data beyond its allocated memory region during out-of-memory events. This can lead to arbitrary memory corruption, potentially causing system instability, GPU hangs, or full system crashes."], "name": "CVE-2026-74454", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74454\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74454\nhttps://lore.kernel.org/linux-cve-announce/2026081531-CVE-2026-74454-8096@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[553c942f8b2cbc7394b4d4fa2f848b23a8f07451,2f2291a119e9a8b696ae8bb36e86b75d272ceaea)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[553c942f8b2cbc7394b4d4fa2f848b23a8f07451,0badb30871004d34df87be33e853536f0b69885f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[553c942f8b2cbc7394b4d4fa2f848b23a8f07451,6cd5acf6f87c073622bd61e38fe99c47365cda9c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[553c942f8b2cbc7394b4d4fa2f848b23a8f07451,1e33ca7f44be64beed2735bb76b86eb65ba8c05b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[553c942f8b2cbc7394b4d4fa2f848b23a8f07451,6395789e4739aa5177bbec0fa0f07ccc38d249b0)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.13"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.13)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.151,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.103,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.44,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.8,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc6,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T16:00:07.794603+00:00", "updated": "2026-08-22T00:30:16.944540+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}