The driver incorrectly assigns the result of krealloc to the original pointer without checking if the call returned NULL, destroying the reference to the previously allocated memory and leaking that memory block. This is a Memory Leak (CWE‑401) vulnerability that, if repeatedly exploited, can exhaust system memory and lead to denial‑of‑service. The vulnerability is limited to a loss of confidentiality, integrity and availability due to resource depletion.

The flaw exists in the Linux kernel’s DRM driver for the VC4 GPU. Any Linux system running a kernel version that includes the legacy drm/vc4 driver without the patch is affected. The patch is referenced by commit identifiers in the provided URLs, but specific kernel versions are not enumerated.

No CVSS score or EPSS score is present, and the vulnerability is not listed in the CISA KEV catalog. Inferred attack vector would be local kernel exploitation, as an attacker must trigger the faulty krealloc path within the DRM driver, which does not provide arbitrary code execution. The risk is primarily denial‑of‑service via memory exhaustion, and the likelihood of exploitation is low unless the attacker has privileged access or can interact with the driver.