CVE-2026-74453

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/vc4: Zero the tile state data array before each BIN job

The binner BO is a single 16MB buffer split into 512KB slots that are

handed out to jobs at submission time and recycled as jobs complete,

without ever being cleared. Each slot holds the job's Tile State Data

Array (TSDA) at its start, followed by the tile allocation pool.

While the tile allocation pool is only walked by the render thread

through branches the binner generated during the current job, the

TSDA is the PTB's own per-tile bookkeeping and is consumed by the

hardware itself. Although the kernel sets the "Auto-initialise Tile

State Data Array" flag in the tile binning mode configuration, the

PTB demonstrably still acts on stale tile state left by the slot's

previous user: the binner ends up creating invalid command streams

with invalid primitive streams and branches, which can cause GPU hangs

as observed in [1][2].

Zero the TSDA when the job's bin

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References