Memory Leak Vulnerability in Linux Kernel's VC4 Driver

CVE-2026-43105

What is CVE-2026-43105?

A vulnerability was identified in the Linux kernel VC4 driver regarding a memory leak of the Buffer Object (BO) array during hang state management. In the vc4_save_hang_state() function, the BO array is allocated using kzalloc() but is never freed in the vc4_free_hang_state() function. This oversight can lead to unnecessary memory retention, potentially causing performance issues and resource exhaustion in long-running applications. The fix involves adding a kfree() call to properly deallocate the BO array before freeing the hang state structure.

References