0.0
NA
CVE-2026-74381
gpu: host1x: Allow entries in BO caches to be freed
Description

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Allow entries in BO caches to be freed When a buffer object is pinned via host1x_bo_pin() with a cache, the resulting mapping is kept in the cache so it can be reused on subsequent pins. Each mapping held a reference to the underlying host1x_bo (taken in tegra_bo_pin / gather_bo_pin), so as long as a mapping was cached, the bo itself could not be freed. However, the only way to remove the cached mapping was through the free path of the buffer object. This meant that if a bo got cached, it could never get freed again. Resolve the circularity by holding a weak reference to the bo from the cache side. This is done by having the .pin callbacks not bump the bo's refcount -- instead the common Host1x bo code does so, except for the cache reference. Also move the remove-cache-mapping-on-free code into a common function inside Host1x code. This is only called from the TegraDRM GEM buffers since those are the only ones that can be cached at the moment.

INFO

Published Date :

Aug. 15, 2026, 6:22 a.m.

Last Modified :

Aug. 15, 2026, 6:22 a.m.

Remotely Exploit :

No

Source :

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products

The following products are affected by CVE-2026-74381 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

No affected product recoded yet

Solution
Update the Linux kernel to resolve a memory corruption vulnerability in the host1x GPU driver.
  • Update the Linux kernel to the latest version.
  • Apply relevant security patches for the host1x driver.
  • Rebuild and redeploy affected systems.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-74381 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-74381 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-74381 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2026-74381 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Aug. 15, 2026

    Action Type Old Value New Value
    Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '1f39b1dfa53c84b56d7ad37fed44afda7004959d', 'lessThan': 'af755456299d44e4ed6af3b7c70a7f03ea37fdf1', 'versionType': 'git'}, {'status': 'affected', 'version': '1f39b1dfa53c84b56d7ad37fed44afda7004959d', 'lessThan': '71c017b3f83ff72638f2a1b1d6d4e7bc61d30231', 'versionType': 'git'}, {'status': 'affected', 'version': '1f39b1dfa53c84b56d7ad37fed44afda7004959d', 'lessThan': '0e9dd7cfb9986b78cc81eca126ccfbf57f4c0602', 'versionType': 'git'}, {'status': 'affected', 'version': '1f39b1dfa53c84b56d7ad37fed44afda7004959d', 'lessThan': '8c0d3cf0d5108c96317e0eca92b60dd368867cef', 'versionType': 'git'}, {'status': 'affected', 'version': '1f39b1dfa53c84b56d7ad37fed44afda7004959d', 'lessThan': 'df63c76f9c8d881ca7bce1aecfba512328d0527d', 'versionType': 'git'}, {'status': 'affected', 'version': '1f39b1dfa53c84b56d7ad37fed44afda7004959d', 'lessThan': '3cbf5e3c46e66d9b3b6b91099bb720c6cb1be3bc', 'versionType': 'git'}], 'programFiles': ['drivers/gpu/drm/tegra/gem.c', 'drivers/gpu/drm/tegra/submit.c', 'drivers/gpu/host1x/bus.c', 'include/linux/host1x.h'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.17'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.17', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/gpu/drm/tegra/gem.c', 'drivers/gpu/drm/tegra/submit.c', 'drivers/gpu/host1x/bus.c', 'include/linux/host1x.h'], 'defaultStatus': 'affected'}]
    Added Description In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Allow entries in BO caches to be freed When a buffer object is pinned via host1x_bo_pin() with a cache, the resulting mapping is kept in the cache so it can be reused on subsequent pins. Each mapping held a reference to the underlying host1x_bo (taken in tegra_bo_pin / gather_bo_pin), so as long as a mapping was cached, the bo itself could not be freed. However, the only way to remove the cached mapping was through the free path of the buffer object. This meant that if a bo got cached, it could never get freed again. Resolve the circularity by holding a weak reference to the bo from the cache side. This is done by having the .pin callbacks not bump the bo's refcount -- instead the common Host1x bo code does so, except for the cache reference. Also move the remove-cache-mapping-on-free code into a common function inside Host1x code. This is only called from the TegraDRM GEM buffers since those are the only ones that can be cached at the moment.
    Added Reference https://git.kernel.org/stable/c/0e9dd7cfb9986b78cc81eca126ccfbf57f4c0602
    Added Reference https://git.kernel.org/stable/c/3cbf5e3c46e66d9b3b6b91099bb720c6cb1be3bc
    Added Reference https://git.kernel.org/stable/c/71c017b3f83ff72638f2a1b1d6d4e7bc61d30231
    Added Reference https://git.kernel.org/stable/c/8c0d3cf0d5108c96317e0eca92b60dd368867cef
    Added Reference https://git.kernel.org/stable/c/af755456299d44e4ed6af3b7c70a7f03ea37fdf1
    Added Reference https://git.kernel.org/stable/c/df63c76f9c8d881ca7bce1aecfba512328d0527d
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.