From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 48FF032B112 for ; Thu, 25 Jun 2026 08:46:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782377207; cv=none; b=bX4+qoFcdRsjoWXbd4Za/90bzLxoABdd6k27zyj9HqfHEt5AFILCQxCUcGqwfC3cED4eSwModGGMuRQJykpp2sLnOInBoylMQyL2AoQScv6/wh29CrXhFKOm5SATT73vTw2g0wDPC7rg9shRXJsm5XPTCVjaQwiIk4DXsx6B7IY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782377207; c=relaxed/simple; bh=yxsNZfeUoebCQYZh/4mf0xV9RtMW666KuJ9mb88r3jw=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=dMcUnd6bWrZGFL7ulwGsL8r0XrfevSjVb56HsBANhDKdDT7SIquTEKe4rEXIdPTYBH2Y/CO1ktmIzsB6cdluSxM7niK7Hw5sYhqix4A73YaqiAIodm2eTx/FUsUpc1MZ4gh/OPeewjyq5Ti2uldiye9goH36yIVOXoaByKsaah8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=XjvlpYBK; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="XjvlpYBK" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 607A71F000E9; Thu, 25 Jun 2026 08:46:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1782377206; bh=W8AfiyhAtsvzzQUDzjeAHiHMkaO+x7n9H6uZ8f9WFK0=; h=From:To:Cc:Subject:Date:Reply-To; b=XjvlpYBKdddlgiHHX1EbVobC97eI7s5f3r5Okawv1mhtCdPmbb4WZev/i0ID9Acgt bwnhqCz37eAXvBYOnQUSXDvg1UwqHSlnZ9tvVa33BqcCsk3MuuaUN1KXKG1QaFL2UC 9CcpZq1LsqaU+fSWhwfeWJGaopRZL+CVI5XFCgnk= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-53213: drm/vc4: fix krealloc() memory leak Date: Thu, 25 Jun 2026 09:41:01 +0100 Message-ID: <2026062503-CVE-2026-53213-e52f@gregkh> X-Mailer: git-send-email 2.54.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3378; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=1oKtnvUtlWzgnwFKocARClrHfq5diF4M1X6MCDyGlfU=; b=owGbwMvMwCRo6H6F97bub03G02pJDFk2L5NZZVmexX+6aL7DaZVt8jOPzhdKsuEOPQqfZt4PD ZwcHaLdEcvCIMjEICumyPJlG8/R/RWHFL0MbU/DzGFlAhnCwMUpABNZMp9hnmLL5NjLTJvCpuRd zdV893PZwml5aQzzNBaUzE+Wjmtk+B99/PNl721XvpjEAQA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: drm/vc4: fix krealloc() memory leak Don't just overwrite the original pointer passed to krealloc() with its return value without checking latter: MEM = krealloc(MEM, SZ, GFP); If krealloc() returns NULL, that erases the pointer to the still allocated memory, hence leaks this memory. Instead, use a temporary variable, check it's not NULL and only then assign it to the original pointer: TMP = krealloc(MEM, SZ, GFP); if (!TMP) return; MEM = TMP; While on it, use krealloc_array(). The Linux kernel CVE team has assigned CVE-2026-53213 to this issue. Affected and fixed versions =========================== Issue introduced in 4.8 with commit 6d45c81d229d71da54d374143e7d6abad4c0cf31 and fixed in 5.15.210 with commit 30165a09f76eaf34951c818eb5d9d6e4771d76f6 Issue introduced in 4.8 with commit 6d45c81d229d71da54d374143e7d6abad4c0cf31 and fixed in 6.1.176 with commit fd87d6966041e33ef7d2e5dc59f9a52b71c6ae5f Issue introduced in 4.8 with commit 6d45c81d229d71da54d374143e7d6abad4c0cf31 and fixed in 6.6.143 with commit e0ce103e89d61eef70edc1d1ae3bfd4c0aacbc2e Issue introduced in 4.8 with commit 6d45c81d229d71da54d374143e7d6abad4c0cf31 and fixed in 6.12.94 with commit c034aa0b1ba5f49cbdf8ef193d6ec714d74aac27 Issue introduced in 4.8 with commit 6d45c81d229d71da54d374143e7d6abad4c0cf31 and fixed in 6.18.36 with commit 02f5e4db57c0cdd7bac89d503b301a093a0fa95c Issue introduced in 4.8 with commit 6d45c81d229d71da54d374143e7d6abad4c0cf31 and fixed in 7.0.13 with commit 4fc692dc6df5bc777cc1bcebf95179e28594875f Issue introduced in 4.8 with commit 6d45c81d229d71da54d374143e7d6abad4c0cf31 and fixed in 7.1 with commit 5d563a5da8717629ae72f9eadf1e0e340bd1658b Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-53213 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/gpu/drm/vc4/vc4_validate_shaders.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/30165a09f76eaf34951c818eb5d9d6e4771d76f6 https://git.kernel.org/stable/c/fd87d6966041e33ef7d2e5dc59f9a52b71c6ae5f https://git.kernel.org/stable/c/e0ce103e89d61eef70edc1d1ae3bfd4c0aacbc2e https://git.kernel.org/stable/c/c034aa0b1ba5f49cbdf8ef193d6ec714d74aac27 https://git.kernel.org/stable/c/02f5e4db57c0cdd7bac89d503b301a093a0fa95c https://git.kernel.org/stable/c/4fc692dc6df5bc777cc1bcebf95179e28594875f https://git.kernel.org/stable/c/5d563a5da8717629ae72f9eadf1e0e340bd1658b