CVE-2026-74381
gpu: host1x: Allow entries in BO caches to be freed
Description
In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Allow entries in BO caches to be freed When a buffer object is pinned via host1x_bo_pin() with a cache, the resulting mapping is kept in the cache so it can be reused on subsequent pins. Each mapping held a reference to the underlying host1x_bo (taken in tegra_bo_pin / gather_bo_pin), so as long as a mapping was cached, the bo itself could not be freed. However, the only way to remove the cached mapping was through the free path of the buffer object. This meant that if a bo got cached, it could never get freed again. Resolve the circularity by holding a weak reference to the bo from the cache side. This is done by having the .pin callbacks not bump the bo's refcount -- instead the common Host1x bo code does so, except for the cache reference. Also move the remove-cache-mapping-on-free code into a common function inside Host1x code. This is only called from the TegraDRM GEM buffers since those are the only ones that can be cached at the moment.
INFO
Published Date :
Aug. 15, 2026, 6:22 a.m.
Last Modified :
Aug. 15, 2026, 6:22 a.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products
The following products are affected by CVE-2026-74381
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
Solution
- Update the Linux kernel to the latest version.
- Apply relevant security patches for the host1x driver.
- Rebuild and redeploy affected systems.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-74381.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-74381 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-74381
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-74381 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-74381 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 15, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '1f39b1dfa53c84b56d7ad37fed44afda7004959d', 'lessThan': 'af755456299d44e4ed6af3b7c70a7f03ea37fdf1', 'versionType': 'git'}, {'status': 'affected', 'version': '1f39b1dfa53c84b56d7ad37fed44afda7004959d', 'lessThan': '71c017b3f83ff72638f2a1b1d6d4e7bc61d30231', 'versionType': 'git'}, {'status': 'affected', 'version': '1f39b1dfa53c84b56d7ad37fed44afda7004959d', 'lessThan': '0e9dd7cfb9986b78cc81eca126ccfbf57f4c0602', 'versionType': 'git'}, {'status': 'affected', 'version': '1f39b1dfa53c84b56d7ad37fed44afda7004959d', 'lessThan': '8c0d3cf0d5108c96317e0eca92b60dd368867cef', 'versionType': 'git'}, {'status': 'affected', 'version': '1f39b1dfa53c84b56d7ad37fed44afda7004959d', 'lessThan': 'df63c76f9c8d881ca7bce1aecfba512328d0527d', 'versionType': 'git'}, {'status': 'affected', 'version': '1f39b1dfa53c84b56d7ad37fed44afda7004959d', 'lessThan': '3cbf5e3c46e66d9b3b6b91099bb720c6cb1be3bc', 'versionType': 'git'}], 'programFiles': ['drivers/gpu/drm/tegra/gem.c', 'drivers/gpu/drm/tegra/submit.c', 'drivers/gpu/host1x/bus.c', 'include/linux/host1x.h'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.17'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.17', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/gpu/drm/tegra/gem.c', 'drivers/gpu/drm/tegra/submit.c', 'drivers/gpu/host1x/bus.c', 'include/linux/host1x.h'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Allow entries in BO caches to be freed When a buffer object is pinned via host1x_bo_pin() with a cache, the resulting mapping is kept in the cache so it can be reused on subsequent pins. Each mapping held a reference to the underlying host1x_bo (taken in tegra_bo_pin / gather_bo_pin), so as long as a mapping was cached, the bo itself could not be freed. However, the only way to remove the cached mapping was through the free path of the buffer object. This meant that if a bo got cached, it could never get freed again. Resolve the circularity by holding a weak reference to the bo from the cache side. This is done by having the .pin callbacks not bump the bo's refcount -- instead the common Host1x bo code does so, except for the cache reference. Also move the remove-cache-mapping-on-free code into a common function inside Host1x code. This is only called from the TegraDRM GEM buffers since those are the only ones that can be cached at the moment. Added Reference https://git.kernel.org/stable/c/0e9dd7cfb9986b78cc81eca126ccfbf57f4c0602 Added Reference https://git.kernel.org/stable/c/3cbf5e3c46e66d9b3b6b91099bb720c6cb1be3bc Added Reference https://git.kernel.org/stable/c/71c017b3f83ff72638f2a1b1d6d4e7bc61d30231 Added Reference https://git.kernel.org/stable/c/8c0d3cf0d5108c96317e0eca92b60dd368867cef Added Reference https://git.kernel.org/stable/c/af755456299d44e4ed6af3b7c70a7f03ea37fdf1 Added Reference https://git.kernel.org/stable/c/df63c76f9c8d881ca7bce1aecfba512328d0527d