CVE-2026-43105: Linux Kernel Memory Leak Vulnerability

CVE-2026-43105 Overview

CVE-2026-43105 is a memory leak vulnerability in the Linux kernel's drm/vc4 graphics driver, which supports the Broadcom VideoCore IV GPU used in Raspberry Pi devices. The flaw resides in the GPU hang state recovery path. The Buffer Object (BO) array allocated by vc4_save_hang_state() using kzalloc() is never released by vc4_free_hang_state(), causing kernel memory to leak each time a GPU hang is captured. The upstream fix adds the missing kfree() call for the BO array before freeing the hang state structure.

Critical Impact
Repeated GPU hang events progressively exhaust kernel memory, which can degrade system stability over time on affected devices.

Affected Products

Linux kernel versions containing the drm/vc4 driver prior to the fix
Systems using Broadcom VideoCore IV GPUs (notably Raspberry Pi platforms)
Distributions shipping unpatched stable kernel branches

Discovery Timeline

2026-05-06 - CVE-2026-43105 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43105

Vulnerability Analysis

The drm/vc4 driver captures diagnostic information when the GPU hangs so userspace can analyze the failure. During this capture, vc4_save_hang_state() allocates a hang state structure and separately allocates an array of Buffer Object handles using kzalloc(). The cleanup routine vc4_free_hang_state() releases the parent structure but does not free the BO array pointer, leaving the allocation orphaned in kernel memory.

Each GPU hang event therefore leaks an allocation sized proportionally to the number of BOs referenced at the time of the hang. On systems where GPU hangs occur repeatedly, the cumulative leak can pressure the kernel slab allocator and reduce available memory for other workloads.

No CWE identifier is currently assigned, but the defect is consistent with a classic memory leak in a kernel cleanup path. The flaw is local in nature and requires conditions that produce GPU hangs to trigger.

Root Cause

The root cause is an incomplete cleanup function. vc4_save_hang_state() performs two separate allocations: one for the hang state container and one for the BO array. vc4_free_hang_state() only frees the container, leaving the BO array allocation unreferenced. The asymmetry between allocation and deallocation paths produces the leak.

Attack Vector

Triggering the leak requires inducing GPU hangs on a system running an affected kernel. A local user with the ability to submit GPU command streams could craft workloads that intentionally hang the VideoCore IV pipeline, repeatedly invoking the hang state capture path. The vulnerability does not provide code execution or privilege escalation. The practical impact is bounded resource exhaustion on the affected device.

The vulnerability is described in prose only; refer to the upstream commits referenced below for the exact patch diff.

Detection Methods for CVE-2026-43105

Indicators of Compromise

Recurring vc4 GPU reset or hang messages in dmesg accompanied by gradual growth of kernel slab memory
Increasing kmalloc-* slab cache sizes in /proc/slabinfo correlated with vc4_save_hang_state invocations
Long-running Raspberry Pi or VideoCore IV systems exhibiting unexplained kernel memory pressure

Detection Strategies

Compare the running kernel version against the fixed commits 0d3c014a8439, 421cea4f71f7, a812008fe3a0, b8138567c4a8, and f4dfd6847b3e to determine exposure
Monitor dmesg for repeated [drm] vc4 hang or reset entries that indicate the leak path is being exercised
Use kmemleak on debug kernels to confirm unfreed allocations originating in vc4_save_hang_state

Monitoring Recommendations

Track per-host kernel memory usage trends and alert on sustained growth without a corresponding workload change
Aggregate kernel log events from edge and embedded fleets into centralized logging to surface repeated GPU hangs
Inventory Raspberry Pi and other VideoCore IV deployments to prioritize patch rollout

How to Mitigate CVE-2026-43105

Immediate Actions Required

Update affected systems to a Linux kernel build that includes the upstream fix referenced in the stable tree commits
Identify all VideoCore IV and Raspberry Pi devices in the environment and schedule kernel updates
Reduce or eliminate workloads that intentionally or accidentally trigger GPU hangs until patches are deployed

Patch Information

The fix adds a kfree() call for the BO array inside vc4_free_hang_state() before the parent hang state structure is released. The patch is available across multiple stable branches via the following commits: Kernel Git Commit 0d3c014, Kernel Git Commit 421cea4, Kernel Git Commit a812008, Kernel Git Commit b813856, and Kernel Git Commit f4dfd68.

Workarounds

Reboot affected devices periodically to reclaim leaked kernel memory until a patched kernel is installed
Restrict untrusted local users from submitting arbitrary GPU command streams on shared systems
On systems that do not require the vc4 driver, blacklist the module to remove the vulnerable code path

bash

# Verify running kernel version and check for the vc4 module
uname -r
lsmod | grep vc4

# After updating, confirm the fix is present in the source tree
git log --oneline drivers/gpu/drm/vc4/vc4_gem.c | grep -i "hang state"