CVE-2026-74454

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size<br /> <br /> vc4_overflow_mem_work() points BPOA at a 512KB slot inside the 16MB<br /> binner BO, but writes the size of the whole BO to BPOS. On every binner<br /> out-of-memory event the PTB is therefore authorized to write tile lists<br /> across all the other slots (which may hold the tile state, tile alloc and<br /> overflow memory of in-flight jobs) and, for any slot but the first, past<br /> the end of the binner BO into unrelated CMA memory.<br /> <br /> Since CMA pages are recycled into page cache and user allocations, this<br /> is arbitrary memory corruption by GPU DMA. In practice it shows up as GPU<br /> hangs with corrupted control list pointers, userspace heap corruption, a<br /> GPU that stays permanently wedged after the first hang, and occasional<br /> full system crashes, whenever a job overflows the initial binner slot.<br /> <br /> The bug dates back to the conversion from a dedicated overflow BO (where<br /> writing the full BO size was correct) to the slotted binner BO.