---
id: CVE-2026-98970
title: 'drm/vc4: Free the BO cache size list on teardown'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/vc4: Free the BO cache size list on teardown

  vc4_bo_cache_destroy() purges the cached BOs but never frees the size
  list, leaking it on every unbind.
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= c826a6e1064419f78855463cf29ce9e8b9d25bf4 <
    bf2848e50bd73782c2942ec023b5b60231f16e9b
  - >-
    Linux >= c826a6e1064419f78855463cf29ce9e8b9d25bf4 <
    035ad1bc964f6698e9b06c26ffe94bcac08dadea
  - >-
    Linux >= c826a6e1064419f78855463cf29ce9e8b9d25bf4 <
    bea10b84e22efa22b005e8dba1a19df4e04a7649
  - >-
    Linux >= c826a6e1064419f78855463cf29ce9e8b9d25bf4 <
    40870a0290cd913c9d94f98ed87ebe00dd091e53
  - >-
    Linux >= c826a6e1064419f78855463cf29ce9e8b9d25bf4 <
    b41ff8b529278216cba22a5dcdc93fea2a3a9619
  - Linux 4.5
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T12:19:43.586Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98970'
references:
  - url: 'https://git.kernel.org/stable/c/bf2848e50bd73782c2942ec023b5b60231f16e9b'
  - url: 'https://git.kernel.org/stable/c/035ad1bc964f6698e9b06c26ffe94bcac08dadea'
  - url: 'https://git.kernel.org/stable/c/bea10b84e22efa22b005e8dba1a19df4e04a7649'
  - url: 'https://git.kernel.org/stable/c/40870a0290cd913c9d94f98ed87ebe00dd091e53'
  - url: 'https://git.kernel.org/stable/c/b41ff8b529278216cba22a5dcdc93fea2a3a9619'
tags:
  - cve.org
ingestedAt: '2026-10-23T13:24:55.553Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/vc4: Free the BO cache size list on teardown

vc4_bo_cache_destroy() purges the cached BOs but never frees the size
list, leaking it on every unbind.

## Affected

- `Linux >= c826a6e1064419f78855463cf29ce9e8b9d25bf4 < bf2848e50bd73782c2942ec023b5b60231f16e9b`
- `Linux >= c826a6e1064419f78855463cf29ce9e8b9d25bf4 < 035ad1bc964f6698e9b06c26ffe94bcac08dadea`
- `Linux >= c826a6e1064419f78855463cf29ce9e8b9d25bf4 < bea10b84e22efa22b005e8dba1a19df4e04a7649`
- `Linux >= c826a6e1064419f78855463cf29ce9e8b9d25bf4 < 40870a0290cd913c9d94f98ed87ebe00dd091e53`
- `Linux >= c826a6e1064419f78855463cf29ce9e8b9d25bf4 < b41ff8b529278216cba22a5dcdc93fea2a3a9619`
- `Linux 4.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.