CVE-2026-98970None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: drm/vc4: Free the BO cache size list on teardown vc4_bo_cache_destroy() purges the cached BOs but never frees the size list, leaking it on every unbind.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
In the Linux kernel, the following vulnerability has been resolved:
drm/vc4: Free the BO cache size list on teardown
vc4_bo_cache_destroy() purges the cached BOs but never frees the size list, leaking it on every unbind.
Linux >= c826a6e1064419f78855463cf29ce9e8b9d25bf4 < bf2848e50bd73782c2942ec023b5b60231f16e9bLinux >= c826a6e1064419f78855463cf29ce9e8b9d25bf4 < 035ad1bc964f6698e9b06c26ffe94bcac08dadeaLinux >= c826a6e1064419f78855463cf29ce9e8b9d25bf4 < bea10b84e22efa22b005e8dba1a19df4e04a7649Linux >= c826a6e1064419f78855463cf29ce9e8b9d25bf4 < 40870a0290cd913c9d94f98ed87ebe00dd091e53Linux >= c826a6e1064419f78855463cf29ce9e8b9d25bf4 < b41ff8b529278216cba22a5dcdc93fea2a3a9619Linux 4.5Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99118Nonedrm/i915/dmc: Harden DMC firmware payload parsing
CVE-2026-99117Nonenet: bridge: mcast: don't truncate the port group walk on teardown
CVE-2026-99121Noneipv4: avoid divide by zero in fib_rebalance
CVE-2026-99120NoneKVM: x86/mmu: Cope with the SS bit being set in #NPF exit codes
CVE-2026-99119Nonedrm/amdgpu/userq: actually validate userq BOs
CVE-2026-99123Nonevsock/virtio: validate packet source for connected sockets