{"id":"CVE-2026-43287","title":"drm: Account property blob allocations to memcg","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm: Account property blob allocations to memcg\n\nDRM_IOCTL_MODE_CREATEPROPBLOB allows userspace to allocate arbitrary-sized\nproperty blobs backed by kernel memory.\n\nCur…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= e2f5d2ea479b9b2619965d43db70939589afe43a < b6117210ed349356f8e6027ff020b4d620bca42b","Linux >= e2f5d2ea479b9b2619965d43db70939589afe43a < 815fa29cab3c67bebb9d0b5f41145cdd3a14d04d","Linux >= e2f5d2ea479b9b2619965d43db70939589afe43a < 866e0c1a9e7244d58ed74853cb22b81e1900cfdd","Linux >= e2f5d2ea479b9b2619965d43db70939589afe43a < bbfaa5761f589a81031b493cb01275a990d6fb25","Linux >= e2f5d2ea479b9b2619965d43db70939589afe43a < 8e1664b9ee43608eb973d357ae5d858d30cbc9ca","Linux >= e2f5d2ea479b9b2619965d43db70939589afe43a < cb8b9a1755fe9f38e4fb7f287486d7e7fab3dba4","Linux >= e2f5d2ea479b9b2619965d43db70939589afe43a < 405fd652d8fedff219a8f48daf8f20e881e303ab","Linux >= e2f5d2ea479b9b2619965d43db70939589afe43a < 26b4309a3ab82a0697751cde52eb336c29c19035","Linux 4.2"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T15:33:21.346571Z"},"published":"2026-05-08","updated":"2026-11-06","sourceUpdated":"2026-11-06T15:42:46.730Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-43287","references":[{"url":"https://git.kernel.org/stable/c/b6117210ed349356f8e6027ff020b4d620bca42b"},{"url":"https://git.kernel.org/stable/c/815fa29cab3c67bebb9d0b5f41145cdd3a14d04d"},{"url":"https://git.kernel.org/stable/c/866e0c1a9e7244d58ed74853cb22b81e1900cfdd"},{"url":"https://git.kernel.org/stable/c/bbfaa5761f589a81031b493cb01275a990d6fb25"},{"url":"https://git.kernel.org/stable/c/8e1664b9ee43608eb973d357ae5d858d30cbc9ca"},{"url":"https://git.kernel.org/stable/c/cb8b9a1755fe9f38e4fb7f287486d7e7fab3dba4"},{"url":"https://git.kernel.org/stable/c/405fd652d8fedff219a8f48daf8f20e881e303ab"},{"url":"https://git.kernel.org/stable/c/26b4309a3ab82a0697751cde52eb336c29c19035"}],"tags":["cve.org"],"epss":0.00123,"epssPercentile":0.02058,"ingestedAt":"2026-11-06T15:54:03.946Z","slug":"CVE-2026-43287","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm: Account property blob allocations to memcg\n\nDRM_IOCTL_MODE_CREATEPROPBLOB allows userspace to allocate arbitrary-sized\nproperty blobs backed by kernel memory.\n\nCurrently, the blob data allocation is not accounted to the allocating\nprocess's memory cgroup, allowing unprivileged users to trigger unbounded\nkernel memory consumption and potentially cause system-wide OOM.\n\nMark the property blob data allocation with GFP_KERNEL_ACCOUNT so that the memory\nis properly charged to the caller's memcg. This ensures existing cgroup\nmemory limits apply and prevents uncontrolled kernel memory growth without\nintroducing additional policy or per-file limits.\n\n## Affected\n\n- `Linux >= e2f5d2ea479b9b2619965d43db70939589afe43a < b6117210ed349356f8e6027ff020b4d620bca42b`\n- `Linux >= e2f5d2ea479b9b2619965d43db70939589afe43a < 815fa29cab3c67bebb9d0b5f41145cdd3a14d04d`\n- `Linux >= e2f5d2ea479b9b2619965d43db70939589afe43a < 866e0c1a9e7244d58ed74853cb22b81e1900cfdd`\n- `Linux >= e2f5d2ea479b9b2619965d43db70939589afe43a < bbfaa5761f589a81031b493cb01275a990d6fb25`\n- `Linux >= e2f5d2ea479b9b2619965d43db70939589afe43a < 8e1664b9ee43608eb973d357ae5d858d30cbc9ca`\n- `Linux >= e2f5d2ea479b9b2619965d43db70939589afe43a < cb8b9a1755fe9f38e4fb7f287486d7e7fab3dba4`\n- `Linux >= e2f5d2ea479b9b2619965d43db70939589afe43a < 405fd652d8fedff219a8f48daf8f20e881e303ab`\n- `Linux >= e2f5d2ea479b9b2619965d43db70939589afe43a < 26b4309a3ab82a0697751cde52eb336c29c19035`\n- `Linux 4.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}