Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-74453— drm/vc4: Zero the tile state data array before each BIN job

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 4.13版本存在安全漏洞，该漏洞源于drm/vc4驱动在每次BIN作业前未清除tile state data array，可能导致GPU挂起。

CVSS 7.8 · High EPSS 0.13% · P2

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 553c942f8b2cbc7394b4d4fa2f848b23a8f07451< c5d8e8e1a8e3b4e464683c5a8a869c16a6382fea affected
553c942f8b2cbc7394b4d4fa2f848b23a8f07451< d3677372e0275e139f0efd2872c5a524b5d12868 affected
553c942f8b2cbc7394b4d4fa2f848b23a8f07451< c8dea7e7c6098e383e44f21a64d0431da5480e3f affected
553c942f8b2cbc7394b4d4fa2f848b23a8f07451< f5802be65535f8818af7191159cf8c11f48ab2a2 affected
553c942f8b2cbc7394b4d4fa2f848b23a8f07451< 0e858422df2334165293ea742da9fbb2e51f2739 affected
553c942f8b2cbc7394b4d4fa2f848b23a8f07451< 57667eb7548faaac396c6e39f3b4444dab5b097c affected
553c942f8b2cbc7394b4d4fa2f848b23a8f07451< a75c8f365e209aa9bb927b0942a7840152d44892 affected
553c942f8b2cbc7394b4d4fa2f848b23a8f07451< 48a570c964d8e37d353381e4195106277e17f5cb affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-74453

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
drm/vc4: Zero the tile state data array before each BIN job
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Zero the tile state data array before each BIN job The binner BO is a single 16MB buffer split into 512KB slots that are handed out to jobs at submission time and recycled as jobs complete, without ever being cleared. Each slot holds the job's Tile State Data Array (TSDA) at its start, followed by the tile allocation pool. While the tile allocation pool is only walked by the render thread through branches the binner generated during the current job, the TSDA is the PTB's own per-tile bookkeeping and is consumed by the hardware itself. Although the kernel sets the "Auto-initialise Tile State Data Array" flag in the tile binning mode configuration, the PTB demonstrably still acts on stale tile state left by the slot's previous user: the binner ends up creating invalid command streams with invalid primitive streams and branches, which can cause GPU hangs as observed in [1][2]. Zero the TSDA when the job's binning slot is configured. This clears 48 bytes per tile (~24KB for a 1080p frame) in the submission path, and guarantees the PTB never sees another job's tile state. The tile count is only checked for being non-zero today, so the 8-bit fields it comes from can describe a tile state array almost six times larger than the slot it has to live in. Bound it before the slot is handed out, since such size decides how much of the slot is left for the tile alloc pool.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 4.13版本存在安全漏洞，该漏洞源于drm/vc4驱动在每次BIN作业前未清除tile state data array，可能导致GPU挂起。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 553c942f8b2cbc7394b4d4fa2f848b23a8f07451 ~ c5d8e8e1a8e3b4e464683c5a8a869c16a6382fea -
Linux Linux 4.13 -

II. Public POCs for CVE-2026-74453

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-74453

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-74453 (8)

Same Patch Batch · Linux · 2026-08-15 · 844 CVEs total

CVE-2026-74280 10.0 CRITICAL crypto: marvell/octeontx - fix DMA cleanup using wrong loop index
CVE-2026-74475 10.0 CRITICAL vxlan: use neigh_ha_snapshot() in route_shortcircuit()
CVE-2026-74279 10.0 CRITICAL crypto: cavium/cpt - fix DMA cleanup using wrong loop index
CVE-2026-72421 10.0 CRITICAL ipv4: fib: Don't ignore error route in local/main tables.
CVE-2026-74309 10.0 CRITICAL vdpa/octeon_ep: fix IRQ-to-ring mapping in interrupt handler
CVE-2026-72407 10.0 CRITICAL geneve: validate inner network offset in geneve_gro_complete()
CVE-2026-72408 10.0 CRITICAL geneve: gate GRO hint in geneve_gro_complete() on gs->gro_hint
CVE-2026-72493 9.9 CRITICAL net: serialize netif_running() check in enqueue_to_backlog()
CVE-2026-72046 9.8 CRITICAL gve: fix header buffer corruption with header-split and HW-GRO
CVE-2026-74376 9.8 CRITICAL md/raid10: reset read_slot when reusing r10bio for discard
CVE-2026-72217 9.8 CRITICAL SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing
CVE-2026-72299 9.8 CRITICAL tipc: restrict socket queue dumps in enqueue tracepoints
CVE-2026-74384 9.8 CRITICAL nvme-multipath: fix flex array size in struct nvme_ns_head
CVE-2026-72210 9.8 CRITICAL ntfs: fix off-by-one in mapping pairs decoding bounds checks
CVE-2026-72211 9.8 CRITICAL ntfs: grow index root value before reparent header update
CVE-2026-72209 9.8 CRITICAL ntfs: validate attribute values on lookup
CVE-2026-72317 9.8 CRITICAL SUNRPC: pin upper rpc_clnt across the TLS connect_worker
CVE-2026-74267 9.8 CRITICAL net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring q
CVE-2026-72206 9.8 CRITICAL ntfs: validate index block header more strictly
CVE-2026-72207 9.8 CRITICAL ntfs: not change 0-byte $DATA attribute to non-resident

Showing top 20 of 844 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-74453

No comments yet

Leave a comment