CVE-2026-74453

Status: UPDATED  |  Advisory ID: CVE-2026-74453

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

drm/vc4: Zero the tile state data array before each BIN job

The binner BO is a single 16MB buffer split into 512KB slots that are

handed out to jobs at submission time and recycled as jobs complete,

without ever being cleared. Each slot holds the job's Tile State Data

Array (TSDA) at its start, followed by the tile allocation pool.

While the tile allocation pool is only walked by the render thread

through branches the binner generated during the current job, the

TSDA is the PTB's own per-tile bookkeeping and is consumed by the

hardware itself. Although the kernel sets the "Auto-initialise Tile

State Data Array" flag in the tile binning mode configuration, the

PTB demonstrably still acts on stale tile state left by the slot's

previous user: the binner ends up creating invalid command streams

with invalid primitive streams and branches, which can cause GPU hangs

as observed in [1][2].

Zero the TSDA when the job's binning slot is configured. This clears

48 bytes per tile (~24KB for a 1080p frame) in the submission path, and

guarantees the PTB never sees another job's tile state.

The tile count is only checked for being non-zero today, so the 8-bit

fields it comes from can describe a tile state array almost six times

larger than the slot it has to live in. Bound it before the slot is

handed out, since such size decides how much of the slot is left for

the tile alloc pool. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References