CVE-2026-98970 - Vulnerability Details - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Free the BO cache size list on teardown vc4_bo_cache_destroy() purges the cached BOs but never frees the size list, leaking it on every unbind.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Linux	Linux Linux Kernel

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/035ad1bc964f6698e9b06c26ffe94bcac08dadea
https://git.kernel.org/stable/c/40870a0290cd913c9d94f98ed87ebe00dd091e53
https://git.kernel.org/stable/c/b41ff8b529278216cba22a5dcdc93fea2a3a9619
https://git.kernel.org/stable/c/bea10b84e22efa22b005e8dba1a19df4e04a7649
https://git.kernel.org/stable/c/bf2848e50bd73782c2942ec023b5b60231f16e9b

History

Fri, 23 Oct 2026 18:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux linux
Vendors & Products		Linux linux

Fri, 23 Oct 2026 12:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Free the BO cache size list on teardown vc4_bo_cache_destroy() purges the cached BOs but never frees the size list, leaking it on every unbind.
Title		drm/vc4: Free the BO cache size list on teardown
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/035ad1bc964f6698e9b06c26ffe94bcac08dadea https://git.kernel.org/stable/c/40870a0290cd913c9d94f98ed87ebe00dd091e53 https://git.kernel.org/stable/c/b41ff8b529278216cba22a5dcdc93fea2a3a9619 https://git.kernel.org/stable/c/bea10b84e22efa22b005e8dba1a19df4e04a7649 https://git.kernel.org/stable/c/bf2848e50bd73782c2942ec023b5b60231f16e9b

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-23T12:19:43.586Z

Updated: 2026-10-23T12:19:43.586Z

Reserved: 2026-09-25T10:25:14.383Z

Link: CVE-2026-98970

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-23T13:17:18.563

Modified: 2026-10-23T13:17:18.563

Link: CVE-2026-98970

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98970", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.383Z", "datePublished": "2026-10-23T12:19:43.586Z", "dateUpdated": "2026-10-23T12:19:43.586Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-23T12:19:43.586Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: Free the BO cache size list on teardown\n\nvc4_bo_cache_destroy() purges the cached BOs but never frees the size\nlist, leaking it on every unbind."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/vc4/vc4_bo.c"], "versions": [{"version": "c826a6e1064419f78855463cf29ce9e8b9d25bf4", "lessThan": "bf2848e50bd73782c2942ec023b5b60231f16e9b", "status": "affected", "versionType": "git"}, {"version": "c826a6e1064419f78855463cf29ce9e8b9d25bf4", "lessThan": "035ad1bc964f6698e9b06c26ffe94bcac08dadea", "status": "affected", "versionType": "git"}, {"version": "c826a6e1064419f78855463cf29ce9e8b9d25bf4", "lessThan": "bea10b84e22efa22b005e8dba1a19df4e04a7649", "status": "affected", "versionType": "git"}, {"version": "c826a6e1064419f78855463cf29ce9e8b9d25bf4", "lessThan": "40870a0290cd913c9d94f98ed87ebe00dd091e53", "status": "affected", "versionType": "git"}, {"version": "c826a6e1064419f78855463cf29ce9e8b9d25bf4", "lessThan": "b41ff8b529278216cba22a5dcdc93fea2a3a9619", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/vc4/vc4_bo.c"], "versions": [{"version": "4.5", "status": "affected"}, {"version": "0", "lessThan": "4.5", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.11", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.5", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.5", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.5", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.5", "versionEndExcluding": "7.2.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.5", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/bf2848e50bd73782c2942ec023b5b60231f16e9b"}, {"url": "https://git.kernel.org/stable/c/035ad1bc964f6698e9b06c26ffe94bcac08dadea"}, {"url": "https://git.kernel.org/stable/c/bea10b84e22efa22b005e8dba1a19df4e04a7649"}, {"url": "https://git.kernel.org/stable/c/40870a0290cd913c9d94f98ed87ebe00dd091e53"}, {"url": "https://git.kernel.org/stable/c/b41ff8b529278216cba22a5dcdc93fea2a3a9619"}], "title": "drm/vc4: Free the BO cache size list on teardown", "x_generator": {"engine": "bippy-1.2.0"}}}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/vc4/vc4_bo.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "bf2848e50bd73782c2942ec023b5b60231f16e9b", "status": "affected", "version": "c826a6e1064419f78855463cf29ce9e8b9d25bf4", "versionType": "git"}, {"lessThan": "035ad1bc964f6698e9b06c26ffe94bcac08dadea", "status": "affected", "version": "c826a6e1064419f78855463cf29ce9e8b9d25bf4", "versionType": "git"}, {"lessThan": "bea10b84e22efa22b005e8dba1a19df4e04a7649", "status": "affected", "version": "c826a6e1064419f78855463cf29ce9e8b9d25bf4", "versionType": "git"}, {"lessThan": "40870a0290cd913c9d94f98ed87ebe00dd091e53", "status": "affected", "version": "c826a6e1064419f78855463cf29ce9e8b9d25bf4", "versionType": "git"}, {"lessThan": "b41ff8b529278216cba22a5dcdc93fea2a3a9619", "status": "affected", "version": "c826a6e1064419f78855463cf29ce9e8b9d25bf4", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/vc4/vc4_bo.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.5"}, {"lessThan": "4.5", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: Free the BO cache size list on teardown\n\nvc4_bo_cache_destroy() purges the cached BOs but never frees the size\nlist, leaking it on every unbind."}], "id": "CVE-2026-98970", "lastModified": "2026-10-23T13:17:18.563", "metrics": {}, "published": "2026-10-23T13:17:18.563", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/035ad1bc964f6698e9b06c26ffe94bcac08dadea"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/40870a0290cd913c9d94f98ed87ebe00dd091e53"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b41ff8b529278216cba22a5dcdc93fea2a3a9619"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bea10b84e22efa22b005e8dba1a19df4e04a7649"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bf2848e50bd73782c2942ec023b5b60231f16e9b"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}