CVE-2026-74416

Received Received - Intake

Memory Leak in Linux Kernel Radeon Driver

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix memory leak in radeon_ring_restore() on lock failure radeon_ring_restore() takes ownership of the data buffer allocated by radeon_ring_backup(). The caller (radeon_gpu_reset()) only frees it in the non-restore branch; in the restore branch it relies on radeon_ring_restore() to free it. If radeon_ring_lock() fails, the function returned early without calling kvfree(data), leaking the ring backup buffer on every GPU reset that fails at the lock stage. During repeated GPU resets this causes cumulative kernel memory exhaustion. Free data before returning the error.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74416

EUVD

EUVD-2026-59563

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a memory leak in the Linux kernel's Radeon GPU driver. The function radeon_ring_restore() is supposed to free a data buffer allocated by radeon_ring_backup(), but fails to do so if radeon_ring_lock() fails. This causes the buffer to leak on every GPU reset that fails at the lock stage, leading to cumulative kernel memory exhaustion during repeated resets.

Detection Guidance

This vulnerability is specific to the Linux kernel's Radeon GPU driver and does not have network-based detection methods. To detect it, monitor kernel memory usage for leaks during GPU reset operations. Check for repeated failures in radeon_ring_lock() using kernel logs or dmesg.

Impact Analysis

This vulnerability can cause your system to run out of memory over time if the GPU reset fails repeatedly. This may lead to system instability, crashes, or degraded performance as kernel memory is exhausted.

Compliance Impact

This vulnerability causes kernel memory exhaustion due to a memory leak during GPU reset failures. It does not directly impact data privacy or security controls required by GDPR or HIPAA. However, memory exhaustion could lead to system instability or crashes, potentially disrupting compliance-related operations.

Mitigation Strategies

Apply the kernel patch that fixes the memory leak in radeon_ring_restore(). Update to a Linux kernel version that includes the fix. If immediate patching is not possible, avoid triggering GPU resets repeatedly to prevent memory exhaustion.

Hi! I’m here to help you understand CVE-2026-74416. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70