CVE-2026-74453: drm/vc4: Zero the tile state data array before each BIN job

CVE-2026-74453: drm/vc4: Zero the tile state data array before each BIN job

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

drm/vc4: Zero the tile state data array before each BIN job

The binner BO is a single 16MB buffer split into 512KB slots that are
handed out to jobs at submission time and recycled as jobs complete,
without ever being cleared. Each slot holds the job's Tile State Data
Array (TSDA) at its start, followed by the tile allocation pool.

While the tile allocation pool is only walked by the render thread
through branches the binner generated during the current job, the
TSDA is the PTB's own per-tile bookkeeping and is consumed by the
hardware itself. Although the kernel sets the "Auto-initialise Tile
State Data Array" flag in the tile binning mode configuration, the
PTB demonstrably still acts on stale tile state left by the slot's
previous user: the binner ends up creating invalid command streams
with invalid primitive streams and branches, which can cause GPU hangs
as observed in [1][2].

Zero the TSDA when the job's binning slot is configured. This clears
48 bytes per tile (~24KB for a 1080p frame) in the submission path, and
guarantees the PTB never sees another job's tile state.

The tile count is only checked for being non-zero today, so the 8-bit
fields it comes from can describe a tile state array almost six times
larger than the slot it has to live in. Bound it before the slot is
handed out, since such size decides how much of the slot is left for
the tile alloc pool.

The Linux kernel CVE team has assigned CVE-2026-74453 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.13 with commit 553c942f8b2cbc7394b4d4fa2f848b23a8f07451 and fixed in 6.6.151 with commit f5802be65535f8818af7191159cf8c11f48ab2a2
	Issue introduced in 4.13 with commit 553c942f8b2cbc7394b4d4fa2f848b23a8f07451 and fixed in 6.12.103 with commit 0e858422df2334165293ea742da9fbb2e51f2739
	Issue introduced in 4.13 with commit 553c942f8b2cbc7394b4d4fa2f848b23a8f07451 and fixed in 6.18.44 with commit 57667eb7548faaac396c6e39f3b4444dab5b097c
	Issue introduced in 4.13 with commit 553c942f8b2cbc7394b4d4fa2f848b23a8f07451 and fixed in 7.1.8 with commit a75c8f365e209aa9bb927b0942a7840152d44892
	Issue introduced in 4.13 with commit 553c942f8b2cbc7394b4d4fa2f848b23a8f07451 and fixed in 7.2-rc6 with commit 48a570c964d8e37d353381e4195106277e17f5cb

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74453
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/gpu/drm/vc4/vc4_validate.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/f5802be65535f8818af7191159cf8c11f48ab2a2
	https://git.kernel.org/stable/c/0e858422df2334165293ea742da9fbb2e51f2739
	https://git.kernel.org/stable/c/57667eb7548faaac396c6e39f3b4444dab5b097c
	https://git.kernel.org/stable/c/a75c8f365e209aa9bb927b0942a7840152d44892
	https://git.kernel.org/stable/c/48a570c964d8e37d353381e4195106277e17f5cb