CVE-2026-53213: Linux Kernel vc4 DRM Memory Leak Denial of Service

Technical summary

The vulnerability is a classic memory leak pattern in the vc4 DRM driver code. When krealloc() is invoked to reallocate memory, the return value is directly assigned to the original pointer without validation. On allocation failure, krealloc() returns NULL while the original block remains allocated but orphaned. The fix implements proper error handling by assigning the krealloc() return value to a temporary variable, checking for NULL, and only then updating the original pointer. Additionally, the patch recommends migrating to krealloc_array() for safer array reallocation semantics.

Business impact

On affected systems, unprivileged local users can repeatedly trigger memory allocation failures in the vc4 driver, gradually exhausting available system memory. This denial-of-service condition degrades performance and may eventually render the system unresponsive. Systems relying on vc4 graphics acceleration (particularly Raspberry Pi and similar platforms) are most susceptible. The impact is localized to availability; there is no confidentiality or integrity risk.

Affected systems

The vulnerability affects the Linux kernel across multiple versions in the vc4 DRM subsystem. Systems using Broadcom VideoCore graphics hardware—particularly Raspberry Pi boards, Pi Compute Modules, and other ARM-based platforms with vc4 driver support—are directly impacted. Any Linux distribution kernel shipping an unpatched version with the vulnerable code path is affected.

Exploitability

Exploitation requires local access and unprivileged user privileges. An attacker with a user account can write a simple program that repeatedly calls kernel functions triggering the krealloc() code path in vc4, causing memory leaks. No special kernel capabilities, hardware manipulation, or user interaction is needed once code execution is achieved. The attack is reliable and straightforward to execute.

Remediation

Apply the latest Linux kernel security update addressing the vc4 krealloc() memory leak. Verify against the vendor advisory for the specific patched kernel version for your distribution. Standard kernel updates from your Linux vendor (Canonical, Red Hat, Debian, Raspberry Pi Foundation, etc.) will include this fix when released. No configuration changes or workarounds are available; kernel patching is the only mitigation.

Patch guidance

Monitor your Linux vendor's security announcements for kernel updates addressing CVE-2026-53213. Test patches in a non-production environment first. For Raspberry Pi users, watch the Raspberry Pi Foundation's security advisories and apply their published kernel updates. For enterprise Linux (RHEL, Ubuntu, Debian), enable automatic security updates or schedule patch windows within your change management process. Verify the patched kernel includes the fix to use safe krealloc() error handling and krealloc_array() where applicable.

Detection guidance

Monitor system memory usage patterns for unexplained, gradual increases in kernel memory consumption. Check kernel logs for memory allocation failures or out-of-memory (OOM) killer events. If using vc4 graphics and observing performance degradation correlating with local user activity, investigate potential exploitation. Memory debugging tools like kmemleak (if enabled in your kernel build) can help identify persistent memory leak patterns attributable to the vc4 driver.

Why prioritize this

This is a MEDIUM severity local denial-of-service vulnerability (CVSS 5.5). While it requires local access and does not threaten confidentiality or integrity, any system allowing unprivileged local users poses a risk. Prioritize patching for: (1) publicly accessible systems where untrusted users can gain shell access, (2) multi-tenant environments, and (3) systems running vc4 that must maintain high availability. Single-user or isolated systems can be deprioritized but should still be patched in regular maintenance windows.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects: Attack Vector of Local (user must have shell access), Attack Complexity Low (straightforward to trigger), Privilege Level Low (unprivileged account sufficient), User Interaction None (automatic upon exploitation), and impact limited to Availability (High denial-of-service impact). The score appropriately reflects the local-only attack surface and availability-only impact; widespread risk is constrained by the requirement for pre-existing local access.

Frequently asked questions