CVE-2026-74453: In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Zero the tile state…

What to know

What it is: In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Zero the tile state data array before each BIN job The binner BO is a single 16MB buffer split into 512KB slots that are handed out to jobs at submission time and recycled as jobs complete, without ever being cleared. Each slot holds the job'…
Affected: Canonical Ubuntu Linux
Fix: Apply the vendor's security update; see the linked advisory.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Canonical Ubuntu Linux: Red, act today. A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests, causing a heap buffer overflow in the NGINX worker process leading to a restart, or potential…

The flaws

CVE-2026-74453: In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Zero the tile state… (CVSS 7.8 · EPSS 0%)
CVE-2026-93479: Heap buffer overflow can lead to remote code execution (CVSS 8.1 · EPSS 1%)
CVE-2026-15176: Heap buffer overflow can lead to remote code execution (CVSS 8.1 · EPSS 1%)
CVE-2026-97205: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module (CVSS 8.1 · EPSS 1%)

The fix

Fix: Check the linked advisory for the concrete fix.

Who is exposed: {'products': ['NGINX Plus', 'NGINX Open Source'], 'packages': [], 'versions': []}

Where it stands

No known exploitation

How it unfolded

26 Oct, Ubuntu security notices (official): USN-8955-1: nginx vulnerabilities
3 Nov, Ubuntu security notices (official): USN-8960-1: Linux kernel (OEM) vulnerabilities
3 Nov, Ubuntu security notices (official): USN-8959-1: Linux kernel vulnerabilities

Connects to

Same weakness: Heap buffer overflow (CWE-122). 398 other warnings in 30 days
Same product: Earlier Canonical Ubuntu Linux warnings. 96 in the last 90 days

Why it is Amber

CVSS 7.8 high
On your watchlist: linux kernel
Named in a government or vendor bulletin

Government and vendor bulletins

References

Original description

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Zero the tile state data array before each BIN job The binner BO is a single 16MB buffer split into 512KB slots that are handed out to jobs at submission time and recycled as jobs complete, without ever being cleared. Each slot holds the job's Tile State Data Array (TSDA) at its start, followed by the tile allocation pool. While the tile allocation pool is only walked by the render thread through branches the binner generated during the current job, the TSDA is the PTB's own per-tile bookkeeping and is consumed by the hardware itself. Although the kernel sets the "Auto-initialise Tile State Data Array" flag in the tile binning mode configuration, the PTB demonstrably still acts on stale tile state left by the slot's previous user: the binner ends up creating invalid command streams with invalid primitive streams and branches, which can cause GPU hangs as observed in [1][2]. Zero the TSDA when the job's binning slot is configured. This clears 48 bytes per tile (~24KB for a 1080p frame) in the submission path, and guarantees the PTB never sees another job's tile state. The tile count is only checked for being non-zero today, so the 8-bit fields it comes from can describe a tile state array almost six times larger than the slot it has to live in. Bound it before the slot is handed out, since such size decides how much of the slot is left for the tile alloc pool.