{"id":"CVE-2026-98970","title":"drm/vc4: Free the BO cache size list on teardown","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: Free the BO cache size list on teardown\n\nvc4_bo_cache_destroy() purges the cached BOs but never frees the size\nlist, leaking it on every unbind.","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= c826a6e1064419f78855463cf29ce9e8b9d25bf4 < bf2848e50bd73782c2942ec023b5b60231f16e9b","Linux >= c826a6e1064419f78855463cf29ce9e8b9d25bf4 < 035ad1bc964f6698e9b06c26ffe94bcac08dadea","Linux >= c826a6e1064419f78855463cf29ce9e8b9d25bf4 < bea10b84e22efa22b005e8dba1a19df4e04a7649","Linux >= c826a6e1064419f78855463cf29ce9e8b9d25bf4 < 40870a0290cd913c9d94f98ed87ebe00dd091e53","Linux >= c826a6e1064419f78855463cf29ce9e8b9d25bf4 < b41ff8b529278216cba22a5dcdc93fea2a3a9619","Linux 4.5"],"published":"2026-10-23","updated":"2026-10-23","sourceUpdated":"2026-10-23T12:19:43.586Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98970","references":[{"url":"https://git.kernel.org/stable/c/bf2848e50bd73782c2942ec023b5b60231f16e9b"},{"url":"https://git.kernel.org/stable/c/035ad1bc964f6698e9b06c26ffe94bcac08dadea"},{"url":"https://git.kernel.org/stable/c/bea10b84e22efa22b005e8dba1a19df4e04a7649"},{"url":"https://git.kernel.org/stable/c/40870a0290cd913c9d94f98ed87ebe00dd091e53"},{"url":"https://git.kernel.org/stable/c/b41ff8b529278216cba22a5dcdc93fea2a3a9619"}],"tags":["cve.org"],"ingestedAt":"2026-10-23T13:24:55.553Z","slug":"CVE-2026-98970","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: Free the BO cache size list on teardown\n\nvc4_bo_cache_destroy() purges the cached BOs but never frees the size\nlist, leaking it on every unbind.\n\n## Affected\n\n- `Linux >= c826a6e1064419f78855463cf29ce9e8b9d25bf4 < bf2848e50bd73782c2942ec023b5b60231f16e9b`\n- `Linux >= c826a6e1064419f78855463cf29ce9e8b9d25bf4 < 035ad1bc964f6698e9b06c26ffe94bcac08dadea`\n- `Linux >= c826a6e1064419f78855463cf29ce9e8b9d25bf4 < bea10b84e22efa22b005e8dba1a19df4e04a7649`\n- `Linux >= c826a6e1064419f78855463cf29ce9e8b9d25bf4 < 40870a0290cd913c9d94f98ed87ebe00dd091e53`\n- `Linux >= c826a6e1064419f78855463cf29ce9e8b9d25bf4 < b41ff8b529278216cba22a5dcdc93fea2a3a9619`\n- `Linux 4.5`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}