CVE-2026-43072: Linux Kernel drm/vc4 IRQ Vulnerability

CVE-2026-43072 Overview

CVE-2026-43072 is a Linux kernel vulnerability in the drm/vc4 Direct Rendering Manager driver used on Broadcom VideoCore IV graphics hardware. The defect involves an improper error check in the driver's interrupt request setup path. The function platform_get_irq_byname() returns a signed integer that may be negative on failure, but the driver passed the value directly into devm_request_threaded_irq() without validation. The Linux kernel maintainers resolved the issue across multiple stable branches.

Critical Impact
Unchecked negative return values from platform_get_irq_byname() can lead to undefined IRQ registration behavior, kernel instability, or denial of service on systems using the vc4 graphics driver.

Affected Products

Linux kernel drm/vc4 driver (Broadcom VideoCore IV / Raspberry Pi GPU)
Multiple stable kernel branches receiving backported fixes
Distributions shipping unpatched vc4 driver builds

Discovery Timeline

2026-05-05 - CVE-2026-43072 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43072

Vulnerability Analysis

The vulnerability resides in the drm/vc4 driver, which manages display and graphics functions for Broadcom VideoCore IV hardware. During driver probe, the code retrieves an interrupt number using platform_get_irq_byname(). This API returns a non-negative IRQ number on success or a negative errno value on failure.

The original code passed this return value directly into devm_request_threaded_irq() without verifying that the returned IRQ number was valid. When platform_get_irq_byname() fails, the negative value flows into IRQ registration logic, producing inconsistent driver state rather than an orderly error path.

Root Cause

The root cause is a missing return value check, classified broadly as an input validation error in kernel driver code. The driver assumed platform_get_irq_byname() would always succeed and did not implement the error handling contract documented for the API. Kernel API contracts require callers to test for negative returns before using the value as an IRQ number.

Attack Vector

The defect is reachable through driver initialization on platforms where IRQ resolution by name fails, for example due to malformed device tree data or hardware enumeration errors. There is no public evidence of remote exploitation. The practical impact is reliability and stability for systems using the vc4 graphics stack, with potential denial of service on the affected subsystem.

No verified exploitation code is available. Refer to the upstream commits referenced in the NVD entry for the precise patch diff and error-path additions.

Detection Methods for CVE-2026-43072

Indicators of Compromise

Kernel log messages indicating failed IRQ requests in the vc4 driver during boot or module load
dmesg entries referencing vc4 probe failures or invalid IRQ numbers
Graphics subsystem unavailability or display initialization failures on Broadcom VideoCore IV hardware

Detection Strategies

Inventory running kernels and compare versions against the fixed commits listed in the NVD references
Audit /proc/version and package manager metadata to confirm vendor backports are applied
Review boot logs for vc4 driver errors that correlate with the unchecked IRQ path

Monitoring Recommendations

Forward dmesg and journalctl -k output to a centralized logging platform for kernel error correlation
Track kernel package versions across Linux fleets and alert on hosts running pre-patch builds
Monitor Raspberry Pi and embedded ARM devices using vc4 for repeated driver probe failures

How to Mitigate CVE-2026-43072

Immediate Actions Required

Update affected systems to a Linux kernel build that includes one of the fix commits referenced by the NVD entry
Prioritize patching on Broadcom VideoCore IV and Raspberry Pi class devices that load the vc4 driver
Validate device tree configurations to ensure IRQ names resolve correctly during probe

Patch Information

The Linux kernel maintainers merged fixes across multiple stable branches. Patch commits include 0185e0494a56, 0c1b117f7ba4, 63c11b19cdc1, 9c10b83a0044, e597a809a2b9, and ef2ee9db13b6. The patches add a check on the return value of platform_get_irq_byname() and return the error before calling devm_request_threaded_irq(). See the Kernel Git Commit references in the NVD entry for complete diffs.

Workarounds

Disable the vc4 driver where graphics functionality is not required by blacklisting the module
Pin device tree configurations known to provide valid named IRQ resources to avoid triggering the failure path
Apply distribution kernel updates as soon as vendors publish backported builds

bash

# Verify running kernel and check for vc4 driver issues
uname -r
dmesg | grep -i vc4

# Optionally blacklist the vc4 module on systems that do not need it
echo "blacklist vc4" | sudo tee /etc/modprobe.d/blacklist-vc4.conf
sudo update-initramfs -u