EUVD-2026-59647
GHSA-c238-677w-2p87
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local access required to submit GPU commands; low privilege sufficient via render group; no user interaction needed; full C/I/A impact from arbitrary CMA corruption.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size
vc4_overflow_mem_work() points BPOA at a 512KB slot inside the 16MB binner BO, but writes the size of the whole BO to BPOS. On every binner out-of-memory event the PTB is therefore authorized to write tile lists across all the other slots (which may hold the tile state, tile alloc and overflow memory of in-flight jobs) and, for any slot but the first, past the end of the binner BO into unrelated CMA memory.
Since CMA pages are recycled into page cache and user allocations, this is arbitrary memory corruption by GPU DMA. In practice it shows up as GPU hangs with corrupted control list pointers, userspace heap corruption, a GPU that stays permanently wedged after the first hang, and occasional full system crashes, whenever a job overflows the initial binner slot.
The bug dates back to the conversion from a dedicated overflow BO (where writing the full BO size was correct) to the slotted binner BO.
AnalysisAI
Arbitrary CMA memory corruption via GPU DMA in the Linux kernel's drm/vc4 VideoCore 4 driver affects Raspberry Pi and similar vc4-based platforms running kernels from version 4.13 through multiple stable series. The vc4_overflow_mem_work() function incorrectly programs BPOS with the full 16MB binner BO size instead of the correct 512KB slot size, authorizing the GPU's PTB hardware to scribble tile lists across adjacent in-flight job memory and into unrelated CMA pages beyond the BO boundary. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) the target system must have a VideoCore 4 GPU (Broadcom BCM283x/BCM2711, i.e., Raspberry Pi hardware) with the vc4 DRM driver loaded; (2) the attacker must have local access sufficient to submit rendering commands to the GPU - typically membership in the 'render' or 'video' group, or direct /dev/dri/renderD* access; (3) a GPU rendering workload must be submitted that is large enough to exhaust the initial 512KB binner slot, triggering the overflow handler. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the technical severity: once triggered, the GPU DMA corruption affects confidentiality, integrity, and availability at high impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local user with access to /dev/dri/renderD* submits a GPU rendering workload that intentionally or incidentally exhausts the initial 512KB binner overflow slot, triggering vc4_overflow_mem_work(). The GPU's PTB hardware, now authorized by BPOS to write up to 16MB, overwrites adjacent binner slots - corrupting tile state and tile alloc data for concurrently running GPU jobs - and for later slots continues past the end of the BO into unrelated CMA pages backing kernel page cache or user heap allocations, causing system instability or potentially positioning heap metadata for further exploitation. … |
| Remediation | The primary fix is to upgrade to a patched kernel version: 6.6.151, 6.12.103, 6.18.44, 7.1.8, or 7.2-rc6, depending on the stable series in use. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Raspberry Pi and VideoCore 4-based systems in your infrastructure, noting which kernels are running and whether GPU workloads are active on each. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today