Out-of-bounds write in Linux kernel - CVE-2026-74454

Vulnerability details

The vulnerability allows a local user to corrupt memory and cause a denial of service.

The vulnerability exists due to an out-of-bounds write in vc4_overflow_mem_work() when handling a binner out-of-memory event. A local user can trigger a GPU job overflow to corrupt memory and cause a denial of service.

The issue arises because the GPU is authorized to DMA beyond the intended 512KB overflow slot, potentially overwriting in-flight job data and unrelated CMA memory.

Affected software

How to mitigate CVE-2026-74454

External References

• https://git.kernel.org/stable/c/0badb30871004d34df87be33e853536f0b69885f
• https://git.kernel.org/stable/c/1e33ca7f44be64beed2735bb76b86eb65ba8c05b
• https://git.kernel.org/stable/c/2f2291a119e9a8b696ae8bb36e86b75d272ceaea
• https://git.kernel.org/stable/c/6395789e4739aa5177bbec0fa0f07ccc38d249b0
• https://git.kernel.org/stable/c/6cd5acf6f87c073622bd61e38fe99c47365cda9c

Related Security Bulletins

• Out-of-bounds write in Linux kernel drm vc4 driver
• Debian update for linux