Answer in brief
CVE-2026-74381 records a Unknown severity vulnerability in gpu: host1x: Allow entries in BO caches to be freed. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=1f39b1dfa53c84b56d7ad37fed44afda7004959d <af755456299d44e4ed6af3b7c70a7f03ea37fdf1 || >=1f39b1dfa53c84b56d7ad37fed44afda7004959d <71c017b3f83ff72638f2a1b1d6d4e7bc61d30231 || >=1f39b1dfa53c84b56d7ad37fed44afda7004959d <0e9dd7cfb9986b78cc81eca126ccfbf57f4c0602 || >=1f39b1dfa53c84b56d7ad37fed44afda7004959d <8c0d3cf0d5108c96317e0eca92b60dd368867cef || >=1f39b1dfa53c84b56d7ad37fed44afda7004959d <df63c76f9c8d881ca7bce1aecfba512328d0527d || >=1f39b1dfa53c84b56d7ad37fed44afda7004959d <3cbf5e3c46e66d9b3b6b91099bb720c6cb1be3bc | af755456299d44e4ed6af3b7c70a7f03ea37fdf1, 71c017b3f83ff72638f2a1b1d6d4e7bc61d30231, 0e9dd7cfb9986b78cc81eca126ccfbf57f4c0602, 8c0d3cf0d5108c96317e0eca92b60dd368867cef, df63c76f9c8d881ca7bce1aecfba512328d0527d, 3cbf5e3c46e66d9b3b6b91099bb720c6cb1be3bc |
| Linux/Linuxgeneric | 5.17 | Not reported |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Allow entries in BO caches to be freed When a buffer object is pinned via host1x_bo_pin() with a cache, the resulting mapping is kept in the cache so it can be reused on subsequent pins. Each mapping held a reference to the underlying host1x_bo (taken in tegra_bo_pin / gather_bo_pin), so as long as a mapping was cached, the bo itself could not be freed. However, the only way to remove the cached mapping was through the free path of the buffer object. This meant that if a bo got cached, it could never get freed again. Resolve the circularity by holding a weak reference to the bo from the cache side. This is done by having the .pin callbacks not bump the bo's refcount -- instead the common Host1x bo code does so, except for the cache reference. Also move the remove-cache-mapping-on-free code into a common function inside Host1x code. This is only called from the TegraDRM GEM buffers since those are the only ones that can be cached at the moment.
Quoted source text, attributed separately from HOL analysis.