CVE-2026-74381

A flaw was found in the gpu: host1x component of the Linux kernel. When a buffer object is pinned with a cache, a circular reference prevents the buffer object from being freed. This issue can lead to a resource leak, potentially allowing a local attacker to cause a Denial of Service (DoS) by exhausting system memory.

This vulnerability is rated as having Moderate impact because it requires local access to interact with the host1x subsystem and only affects hardware utilizing NVIDIA Tegra processors. While an authenticated local user could induce system memory exhaustion over extended periods through unreleased buffer cache mappings, the flaw cannot be triggered remotely and does not lead to privilege escalation or data exposure. Furthermore, typical enterprise environments running on non-Tegra platforms do not exercise the vulnerable driver code.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.