The Linux kernel VC4 driver fails to clear memory buffers between jobs, creating a high-risk information disclosure vulnerability for authenticated local users.

The VC4 DRM driver fails to zero out the tile state data array in the binner buffer object before reusing it for subsequent jobs. This allows an authenticated local attacker to read data left over from previous processes.

The CVSS score of 7.8 reflects the high risk of sensitive data exposure. If an attacker can read residual data from memory, they may be able to extract cryptographic keys, credentials, or other proprietary information, leading to significant security breaches and data loss.

Immediate Action: Update the Linux kernel to version 6.6.151, 6.12.103, 6.18.44, 7.1.8, or later to ensure memory buffers are properly cleared.

Proactive Monitoring: Monitor for suspicious processes that may be attempting to read raw memory or interface with graphics buffers in an unauthorized manner.

Compensating Controls: Minimize the exposure of sensitive data in memory by ensuring that multi-tenant environments are properly isolated at the hardware or kernel level.

Public Exploit Available: No (exploit_available: false)

Information disclosure flaws in the kernel are critical due to the potential for cross-process data leakage. It is strongly recommended that all systems utilizing the VC4 DRM driver be updated to the latest available kernel versions to remediate this issue.