CVE-2026-98970None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: drm/vc4: Free the BO cache size list on teardown vc4_bo_cache_destroy() purges the cached BOs but never frees the size list, leaking it on every unbind.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
In the Linux kernel, the following vulnerability has been resolved:
drm/vc4: Free the BO cache size list on teardown
vc4_bo_cache_destroy() purges the cached BOs but never frees the size list, leaking it on every unbind.
Linux >= c826a6e1064419f78855463cf29ce9e8b9d25bf4 < bf2848e50bd73782c2942ec023b5b60231f16e9bLinux >= c826a6e1064419f78855463cf29ce9e8b9d25bf4 < 035ad1bc964f6698e9b06c26ffe94bcac08dadeaLinux >= c826a6e1064419f78855463cf29ce9e8b9d25bf4 < bea10b84e22efa22b005e8dba1a19df4e04a7649Linux >= c826a6e1064419f78855463cf29ce9e8b9d25bf4 < 40870a0290cd913c9d94f98ed87ebe00dd091e53Linux >= c826a6e1064419f78855463cf29ce9e8b9d25bf4 < b41ff8b529278216cba22a5dcdc93fea2a3a9619Linux 4.5Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99001Nonedrm/xe/i2c: cancel the client work on remove
CVE-2026-98989Nonenamespace: check a recursive bind mount for mount namespace loops
CVE-2026-98988Nonenamespace: keep covered mounts covered in OPEN_TREE_NAMESPACE
CVE-2026-98992Nonenamespace: don't copy an unmounted mount tree
CVE-2026-98991Nonenamespace: queue a mount only once for mount notifications
CVE-2026-98990Nonenamespace: check a submount for references right before unmounting it