CVE-2026-43104: Linux Kernel Memory Leak Vulnerability

CVE-2026-43104 Overview

CVE-2026-43104 is a memory leak vulnerability in the Linux kernel's drm/vc4 direct rendering manager (DRM) driver, which supports the VideoCore IV GPU on Broadcom platforms such as the Raspberry Pi. The flaw resides in the vc4_save_hang_state() function. When the function hits an early return condition, it exits without freeing the previously allocated kernel_state structure, resulting in a kernel memory leak [CWE-401].

The upstream fix consolidates the early return paths into a single location and adds the missing kfree() calls. Patches were committed across multiple stable kernel branches.

Critical Impact
Repeated triggering of the GPU hang state error path can exhaust kernel memory, leading to degraded system stability or denial of service on affected Linux systems.

Affected Products

Linux kernel drm/vc4 driver (Broadcom VideoCore IV GPU)
Linux distributions shipping affected kernel versions prior to the stable patches
Embedded and Raspberry Pi platforms using the vc4 DRM driver

Discovery Timeline

2026-05-06 - CVE-2026-43104 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43104

Vulnerability Analysis

The vulnerability resides in vc4_save_hang_state(), a function in the drm/vc4 driver responsible for capturing GPU state when the VideoCore IV GPU hangs. The function allocates a kernel_state structure to hold diagnostic data about the hung GPU.

Under normal flow, kernel_state is consumed and released as part of the hang state reporting lifecycle. However, the function contains early return paths triggered when prerequisite conditions are not met. On these paths, the allocated kernel_state reference is dropped without invoking kfree(), leaving the allocation orphaned in kernel memory.

Each occurrence leaks a small but non-trivial amount of kernel heap memory. Over time, repeated GPU hang events accumulate leaked allocations, contributing to memory pressure on long-running systems.

Root Cause

The root cause is missing cleanup logic on error paths. The function allocates kernel_state early but does not have a unified error-handling block that releases the allocation when subsequent checks fail. The patch resolves this by consolidating multiple early return statements into a single exit path that performs the required kfree() call before returning.

Attack Vector

Triggering the leak requires conditions that cause the vc4 GPU hang state handler to take the early return branch. Local users with the ability to interact with the DRM device or trigger GPU hangs may repeatedly invoke the path. Remote exploitation is not applicable, and the vulnerability does not enable code execution or privilege escalation on its own.

The practical impact is constrained to resource exhaustion on systems that use the vc4 driver and experience repeated GPU hang conditions. The vulnerability is described in prose rather than with code samples, as no public exploit is available. See the upstream commits referenced below for the exact source-level changes.

Detection Methods for CVE-2026-43104

Indicators of Compromise

Gradual increase in unaccounted kernel slab allocations on systems using the vc4 DRM driver, visible in /proc/slabinfo and /proc/meminfo.
Recurring GPU hang messages from the vc4 driver in dmesg or the system journal correlated with rising kernel memory usage.
Long-running Raspberry Pi or VideoCore IV based systems exhibiting unexplained kernel memory growth without corresponding userspace allocations.

Detection Strategies

Monitor kernel log entries originating from the vc4 driver for repeated hang state save events using journalctl -k -g vc4.
Track kernel slab usage with slabtop and watch for sustained growth in generic kmalloc slabs on affected hosts.
Compare the running kernel version against the fixed commits (3eb7dd5, 9525d16, d8fdd6a, dd5c497, e352e9a) to determine exposure.

Monitoring Recommendations

Deploy host telemetry that captures kernel memory metrics over time and alerts on abnormal upward drift.
Aggregate dmesg output centrally to correlate vc4 hang events across fleets of embedded or single-board computer deployments.
Track package and kernel update status to confirm the patched version is rolled out across affected endpoints.

How to Mitigate CVE-2026-43104

Immediate Actions Required

Update affected Linux kernels to a stable release containing the upstream fix referenced by commits 3eb7dd5, 9525d16, d8fdd6a, dd5c497, and e352e9a.
Inventory systems running the vc4 driver, particularly Raspberry Pi and other Broadcom VideoCore IV based devices.
Restart affected hosts after updating the kernel to ensure the patched module is loaded.

Patch Information

The fix consolidates the early return paths in vc4_save_hang_state() into a single exit point and adds the missing kfree() calls for the allocated kernel_state. The patch is available in stable kernel trees through the upstream commits listed above. Distribution maintainers backport the fix into supported kernel branches.

Workarounds

If patching is not immediately possible, avoid workloads that repeatedly trigger GPU hangs on the vc4 driver to limit leak accumulation.
Schedule periodic reboots on long-running embedded systems to reclaim leaked kernel memory until the patched kernel is deployed.
Restrict local access to the affected hosts so that only trusted users can interact with the DRM device interfaces.

bash

# Verify running kernel version and check for the vc4 driver
uname -r
lsmod | grep vc4

# Apply distribution kernel updates (Debian/Raspberry Pi OS example)
sudo apt update && sudo apt full-upgrade
sudo reboot