{"id":"CVE-2026-98970","kind":"vulnerability","aliases":["CVE-2026-98970"],"related":[],"title":"Linux kernel vc4 DRM driver leaks buffer cache size list on teardown","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: Free the BO cache size list on teardown\n\nvc4_bo_cache_destroy() purges the cached BOs but never frees the size\nlist, leaking it on every unbind.","summary":"On teardown of the vc4 DRM graphics driver, the buffer object cache is purged but its size list is never freed, so memory leaks on every driver unbind. The sources describe only a memory leak with no code execution or data exposure.","severity":"unknown","cvss":null,"epss":0.00209,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drm-vc4","infrastructure","linux-kernel","raspberry-pi"],"not_affected_if":["driver-never-unbound","no-vc4-driver"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-23T13:17:18+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:56:27+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T04:56:27Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel vc4 DRM driver leaks buffer cache size list on teardown","impact":"low","summary":"On teardown of the vc4 DRM graphics driver, the buffer object cache is purged but its size list is never freed, so memory leaks on every driver unbind. The sources describe only a memory leak with no code execution or data exposure.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","raspberry-pi","drm-vc4"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Kernel memory leaks on each driver unbind; no code execution described.","analyst_note":"","how_to_check":"unknown","needs_analyst":false,"not_affected_if":["no-vc4-driver","driver-never-unbound"],"who_is_affected":"Systems running a Linux kernel with the vc4 DRM driver, which is used on Raspberry Pi graphics hardware. The leak only occurs when the driver is unbound, so systems that never unbind it are unlikely to notice. The sources do not say which kernel versions are affected or which are patched.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000545,"input_tokens":3300,"output_tokens":430,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98970':15A,18A 'bo':84C,91C 'bos':97C 'buffer':7A,38B 'cach':8A,40B,85C,92C,96C 'code':66B 'cve':13A,16A 'data':69B 'describ':59B 'destroy':93C 'driver':5A,36B,55B 'drm':4A,20B,34B 'drm-vc4':19B 'drm/vc4':81C 'everi':54B,107C 'execut':67B 'exposur':70B 'follow':76C 'free':82C,100C 'freed':49B 'graphic':35B 'infrastructur':22B 'kernel':2A,25B,74C 'leak':6A,52B,63B,104C 'linux':1A,24B,73C 'linux-kernel':23B 'list':10A,46B,87C,103C 'memori':51B,62B 'never':48B,99C 'object':39B 'pi':28B 'purg':42B,94C 'raspberri':27B 'raspberry-pi':26B 'resolv':80C 'size':9A,45B,86C,102C 'sourc':58B 'teardown':12A,30B,89C 'unbind':56B,108C 'vc4':3A,21B,33B,90C 'vulner':77C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the vc4 DRM driver, which is used on Raspberry Pi graphics hardware. The leak only occurs when the driver is unbound, so systems that never unbind it are unlikely to notice. The sources do not say which kernel versions are affected or which are patched.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:18+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98970","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98970","severity":null,"published_at":"2026-10-23T13:17:18+00:00","modified_at":"2026-10-23T13:17:18+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98970","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98970","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}