CVE-2026-74454

A moderate out-of-bounds write flaw was found in the Linux kernel drm/vc4 GPU driver. The vc4_overflow_mem_work() function points the BPOA register at a 512KB overflow slot inside the 16MB binner buffer object (BO), but writes the size of the whole BO to the BPOS register. On every binner out-of-memory event, the GPU binner (PTB) is therefore authorized to write tile lists across the other slots of the BO, which may hold the tile state, tile allocation, and overflow memory of in-flight jobs, and, for any slot but the first, past the end of the BO into unrelated CMA memory. Since CMA pages are recycled into the page cache and user allocations, a local user able to submit GPU jobs can trigger arbitrary memory corruption by GPU DMA whenever a job overflows the initial binner slot. In practice this manifests as GPU hangs with corrupted control list pointers, userspace heap corruption, a GPU that stays permanently wedged after the first hang, and occasional full system crashes. Red Hat Product Security rates this flaw Moderate (CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), weighing the availability-focused impact on Red Hat offerings, whereas the upstream CVE record assigns Important (7.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) by also crediting potential confidentiality and integrity impact. All Red Hat Enterprise Linux (including kernel-rt) and Red Hat In-Vehicle OS kernel streams are not affected because the vulnerable code is not present in the shipped kernels.