An oversight in the Linux kernel’s Direct Rendering Manager (DRM) graphics driver common code could allow unprivileged users to trigger unbounded kernel memory consumption for a potential system-wide out-of-memory “OOM” situation.

It turns out the DRM driver’s DRM_IOCTL_MODE_CREATEPROPBLOB interface for letting user-space allocate arbitrary-sized property blobs wasn’t properly accounting for that kernel memory. The blob allocations were not attributed to the memory control group “memcg” of the user process. Thus unprivileged users potentially causing unbounded kernel memory consumption to the point of triggering system out-of-memory errors.