---
id: "CVE-2026-98970"
kind: "vulnerability"
aliases: ["CVE-2026-98970"]
title: "Linux kernel vc4 DRM driver leaks buffer cache size list on teardown"
severity: "unknown"
cvss: null
epss: 0.00209
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["drm-vc4", "infrastructure", "linux-kernel", "raspberry-pi"]
not_affected_if: ["driver-never-unbound", "no-vc4-driver"]
published_at: "2026-10-23T13:17:18+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98970", "first_seen_at": "2026-10-23T21:57:33+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-98970", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# Linux kernel vc4 DRM driver leaks buffer cache size list on teardown

On teardown of the vc4 DRM graphics driver, the buffer object cache is purged but its size list is never freed, so memory leaks on every driver unbind. The sources describe only a memory leak with no code execution or data exposure.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98970
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-98970

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

drm/vc4: Free the BO cache size list on teardown

vc4_bo_cache_destroy() purges the cached BOs but never frees the size
list, leaking it on every unbind.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_