CVE-2026-74393

A flaw was found in the Linux kernel's drm/syncobj component. The drm_syncobj_find_fence() function fails to properly release a reference to a syncobj object, which is acquired by drm_syncobj_find(). This oversight leads to a memory leak. A local attacker could exploit this vulnerability to consume system memory, potentially leading to a Denial of Service (DoS).

This vulnerability is rated as Moderate because an authenticated local user can trigger unreleased kernel reference counts to exhaust system memory, resulting in a denial-of-service condition without permitting privilege escalation or data exposure. Exploitation relies on interacting with Direct Rendering Manager device nodes, which are typically restricted to users with direct graphical access or specific render group permissions. Standard server deployments lacking GPU acceleration or restricting unprivileged access to DRM devices face reduced exposure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.