CVE-2026-53213 Overview
CVE-2026-53213 is a memory leak vulnerability in the Linux kernel's Broadcom VideoCore IV (drm/vc4) Direct Rendering Manager (DRM) driver. The flaw stems from unsafe usage of krealloc() where the original pointer is overwritten directly with the return value. When krealloc() returns NULL due to allocation failure, the original pointer to the still-allocated memory is erased, leaking the memory region. The issue has been resolved upstream by introducing a temporary variable to validate the return value before reassignment, and by migrating to krealloc_array() for safer array allocations.
Critical Impact
Repeated failed reallocations in the drm/vc4 driver can leak kernel memory, contributing to resource exhaustion on affected Linux systems, particularly Raspberry Pi devices using VideoCore IV graphics.
Affected Products
- Linux kernel (mainline and stable trees containing the drm/vc4 driver)
- Systems using Broadcom VideoCore IV GPUs (Raspberry Pi platforms)
- Distributions shipping vulnerable kernel versions prior to the fix commits
Discovery Timeline
- 2026-06-25 - CVE-2026-53213 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-53213
Vulnerability Analysis
The vulnerability resides in the drm/vc4 kernel driver, which supports the VideoCore IV graphics processor. The driver uses krealloc() to resize allocated buffers but assigns the return value directly back to the original pointer. This pattern follows the form MEM = krealloc(MEM, SZ, GFP);.
When krealloc() cannot satisfy the allocation request, it returns NULL while leaving the originally allocated memory intact. The direct assignment overwrites the only reference to that memory, making it unreachable. The kernel cannot reclaim the orphaned allocation until reboot, creating a persistent memory leak under allocation pressure.
Root Cause
The root cause is improper handling of krealloc() failure semantics, a classic Memory Leak pattern. The fix introduces a temporary variable to test the return value before reassignment: TMP = krealloc(MEM, SZ, GFP); if (!TMP) return; MEM = TMP;. The patches also adopt krealloc_array(), which provides built-in overflow checking when reallocating arrays.
Attack Vector
Triggering the leak requires interaction with the drm/vc4 driver paths that perform reallocations under conditions where the kernel allocator fails. A local user with access to the DRM subsystem could potentially induce repeated allocation failures, gradually exhausting kernel memory. The vulnerability does not provide direct code execution or privilege escalation, but it degrades system reliability over time.
No public proof-of-concept exploits are available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the upstream commits including Linux Kernel Commit #02f5e4d and Linux Kernel Commit #fd87d69 for the patch implementation.
Detection Methods for CVE-2026-53213
Indicators of Compromise
- Steadily increasing kernel slab memory consumption without corresponding workload growth, visible in /proc/slabinfo and /proc/meminfo.
- Allocation failure messages from the vc4 driver in dmesg or journalctl -k logs.
- Out-of-memory (OOM) killer activity on systems running graphics workloads against the VideoCore IV GPU.
Detection Strategies
- Compare running kernel versions against the fixed commits referenced in the upstream stable trees to identify unpatched systems.
- Monitor long-running Raspberry Pi or VideoCore IV systems for unexplained kernel memory growth using slabtop and vmstat.
- Audit kernel build configurations for CONFIG_DRM_VC4 and ensure patched sources are deployed.
Monitoring Recommendations
- Track kernel memory metrics over time and alert on sustained slab growth trends.
- Enable kernel memory leak detection (CONFIG_DEBUG_KMEMLEAK) on test systems to validate patch deployment.
- Centralize kernel logs in a SIEM and flag repeated vc4 allocation warnings or OOM events.
How to Mitigate CVE-2026-53213
Immediate Actions Required
- Update the Linux kernel to a version that includes the upstream drm/vc4krealloc() fix commits.
- Inventory all systems running the vc4 driver, particularly Raspberry Pi fleets, and prioritize them for patching.
- Restart affected systems after patching to clear any memory already leaked by the unpatched driver.
Patch Information
The fix is distributed across multiple stable kernel branches. Relevant upstream commits include Linux Kernel Commit #02f5e4d, Linux Kernel Commit #30165a0, Linux Kernel Commit #4fc692d, Linux Kernel Commit #5d563a5, Linux Kernel Commit #c034aa0, Linux Kernel Commit #e0ce103, and Linux Kernel Commit #fd87d69. Apply distribution-provided kernel updates as soon as they become available.
Workarounds
- If patching is not immediately feasible, schedule periodic reboots of affected systems to reclaim leaked kernel memory.
- Unload the vc4 driver on systems that do not require VideoCore IV graphics acceleration using modprobe -r vc4.
- Restrict local access to the DRM subsystem on multi-user systems to reduce the risk of allocation pressure being induced by untrusted users.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
