CVE-2026-53213 - Vulnerability Details

- drm/vc4: fix krealloc() memory leak

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/vc4: fix krealloc() memory leak

Don't just overwrite the original pointer passed to krealloc()
with its return value without checking latter:

MEM = krealloc(MEM, SZ, GFP);

If krealloc() returns NULL, that erases the pointer
to the still allocated memory, hence leaks this memory.
Instead, use a temporary variable, check it's not NULL
and only then assign it to the original pointer:

TMP = krealloc(MEM, SZ, GFP);
if (!TMP) return;
MEM = TMP;

While on it, use krealloc_array().

Published: 2026-06-25

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The driver incorrectly assigns the result of krealloc to the original pointer without checking if the call returned NULL, destroying the reference to the previously allocated memory and leaking that memory block. This is an Incorrect Check of Return Value (CWE‑253) vulnerability that, if repeatedly exploited, can exhaust system memory andservice. The vulnerability is limited to availability, as memory exhaustion can cause denial‑of‑service.

Affected Systems

The flaw exists in the Linux kernel’s DRM driver for the VC4 GPU. Any Linux system running a kernel version that includes the legacy drm/vc4 driver without the patch is affected. The patch is referenced by commit identifiers; versions are not enumerated.

Risk and Exploitability

No CVSS score is provided, but the EPSS score indicates a probability of less than 1%, and the vulnerability is not listed in the CISA KEV catalog. Inferred attack vector would be local kernel exploitation, as an attacker must trigger the faulty krealloc path within the DRM driver, which does not provide arbitrary code execution. The risk is primarily denial‑of‑service via memory exhaustion can interact with the driver.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`6d45c81d229d71da54d374143e7d6abad4c0cf31`	affected	< 30165a09f76eaf34951c818eb5d9d6e4771d76f6
`6d45c81d229d71da54d374143e7d6abad4c0cf31`	affected	< fd87d6966041e33ef7d2e5dc59f9a52b71c6ae5f
`6d45c81d229d71da54d374143e7d6abad4c0cf31`	affected	< e0ce103e89d61eef70edc1d1ae3bfd4c0aacbc2e
`6d45c81d229d71da54d374143e7d6abad4c0cf31`	affected	< c034aa0b1ba5f49cbdf8ef193d6ec714d74aac27
`6d45c81d229d71da54d374143e7d6abad4c0cf31`	affected	< 02f5e4db57c0cdd7bac89d503b301a093a0fa95c
`6d45c81d229d71da54d374143e7d6abad4c0cf31`	affected	< 4fc692dc6df5bc777cc1bcebf95179e28594875f
`6d45c81d229d71da54d374143e7d6abad4c0cf31`	affected	< 5d563a5da8717629ae72f9eadf1e0e340bd1658b

Linux

affected

Version	Status	Constraints
`4.8`	affected	—
`0`	unaffected	< 4.8
`5.15.210`	unaffected	≤ 5.15.*
`6.1.176`	unaffected	≤ 6.1.*
`6.6.143`	unaffected	≤ 6.6.*
`6.12.94`	unaffected	≤ 6.12.*
`6.18.36`	unaffected	≤ 6.18.*
`7.0.13`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[6d45c81d229d71da54d374143e7d6abad4c0cf31,30165a09f76eaf34951c818eb5d9d6e4771d76f6)`	affected	code_commit	—
`[6d45c81d229d71da54d374143e7d6abad4c0cf31,fd87d6966041e33ef7d2e5dc59f9a52b71c6ae5f)`	affected	code_commit	—
`[6d45c81d229d71da54d374143e7d6abad4c0cf31,e0ce103e89d61eef70edc1d1ae3bfd4c0aacbc2e)`	affected	code_commit	—
`[6d45c81d229d71da54d374143e7d6abad4c0cf31,c034aa0b1ba5f49cbdf8ef193d6ec714d74aac27)`	affected	code_commit	—
`[6d45c81d229d71da54d374143e7d6abad4c0cf31,02f5e4db57c0cdd7bac89d503b301a093a0fa95c)`	affected	code_commit	—
`[6d45c81d229d71da54d374143e7d6abad4c0cf31,4fc692dc6df5bc777cc1bcebf95179e28594875f)`	affected	code_commit	—
`[6d45c81d229d71da54d374143e7d6abad4c0cf31,5d563a5da8717629ae72f9eadf1e0e340bd1658b)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.8`	affected	generic	—
`[0,4.8)`	unaffected	generic	—
`[5.15.210,5.16.0)`	unaffected	semver	—
`[6.1.176,6.2.0)`	unaffected	semver	—
`[6.6.143,6.7.0)`	unaffected	semver	—
`[6.12.94,6.13.0)`	unaffected	semver	—
`[7.0.13,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply a kernel update that includes the patch referenced by the provided commit URLs
Reboot the system after updating to ensure the patched driver is loaded
Monitor system memory usage and GPU activity for signs of memory leakage

Generated by OpenCVE AI on June 26, 2026 at 17:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4665-1	linux security update
Debian DLA	DLA-4671-1	linux-6.1 security update

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00128.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/02f5e4db57c0cdd7bac89d503b301a093a0fa95c
https://git.kernel.org/stable/c/30165a09f76eaf34951c818eb5d9d6e4771d76f6
https://git.kernel.org/stable/c/4fc692dc6df5bc777cc1bcebf95179e28594875f
https://git.kernel.org/stable/c/5d563a5da8717629ae72f9eadf1e0e340bd1658b
https://git.kernel.org/stable/c/c034aa0b1ba5f49cbdf8ef193d6ec714d74aac27
https://git.kernel.org/stable/c/e0ce103e89d61eef70edc1d1ae3bfd4c0aacbc2e
https://git.kernel.org/stable/c/fd87d6966041e33ef7d2e5dc59f9a52b71c6ae5f
https://lore.kernel.org/linux-cve-announce/2026062503-CVE-2026-53213-e52f@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-53213
https://www.cve.org/CVERecord?id=CVE-2026-53213

History

Fri, 26 Jun 2026 15:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-401

Fri, 26 Jun 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-253
References		https://lore.kernel.org/linux-cve-announce/2026062503-CVE-2026-53213-e52f@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-53213 https://www.cve.org/CVERecord?id=CVE-2026-53213
Metrics	threat_severity `None`	threat_severity `Moderate`

Thu, 25 Jun 2026 11:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-401

Thu, 25 Jun 2026 09:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: drm/vc4: fix krealloc() memory leak Don't just overwrite the original pointer passed to krealloc() with its return value without checking latter: MEM = krealloc(MEM, SZ, GFP); If krealloc() returns NULL, that erases the pointer to the still allocated memory, hence leaks this memory. Instead, use a temporary variable, check it's not NULL and only then assign it to the original pointer: TMP = krealloc(MEM, SZ, GFP); if (!TMP) return; MEM = TMP; While on it, use krealloc_array().
Title		drm/vc4: fix krealloc() memory leak
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/02f5e4db57c0cdd7bac89d503b301a093a0fa95c https://git.kernel.org/stable/c/30165a09f76eaf34951c818eb5d9d6e4771d76f6 https://git.kernel.org/stable/c/4fc692dc6df5bc777cc1bcebf95179e28594875f https://git.kernel.org/stable/c/5d563a5da8717629ae72f9eadf1e0e340bd1658b https://git.kernel.org/stable/c/c034aa0b1ba5f49cbdf8ef193d6ec714d74aac27 https://git.kernel.org/stable/c/e0ce103e89d61eef70edc1d1ae3bfd4c0aacbc2e https://git.kernel.org/stable/c/fd87d6966041e33ef7d2e5dc59f9a52b71c6ae5f

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-06-25T08:39:17.552Z

Updated: 2026-06-25T08:39:17.552Z

Reserved: 2026-06-09T07:44:35.392Z

Link: CVE-2026-53213

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Moderate

Publid Date: 2026-06-25T00:00:00Z

Links: CVE-2026-53213 - Bugzilla

OpenCVE Enrichment

Updated: 2026-06-26T18:00:06Z

Weaknesses

CWE-253
Incorrect Check of Function Return Value

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object