In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Free the BO cache size list on teardown vc4_bo_cache_destroy() purges… (CVE-2026-98970)

The Linux kernel's drm/vc4 subsystem had a vulnerability identified as CVE-2026-98970, where the function vc4_bo_cache_destroy() purged cached buffer objects (BOs) but failed to free the associated size list, causing a memory leak on every unbind. This defect could lead to resource exhaustion over time if the leak accumulates. The vulnerability has been resolved by modifying the teardown process to free the BO cache size list correctly.

The vulnerability causes a memory leak in the drm/vc4 kernel component, which may lead to increased memory consumption and potential resource exhaustion on affected systems. There is no indication of direct code execution or privilege escalation impact. No known exploits in the wild have been reported.

A fix has been implemented to free the BO cache size list during teardown in vc4_bo_cache_destroy(). Users should apply the official Linux kernel updates that include this fix to remediate the vulnerability. No additional mitigation steps are indicated.