CVE-2026-53140: drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups
In the Linux kernel, the following vulnerability has been resolved:
drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups
v3drewritecsdjobwgcountsfromindirect() maps both the indirect buffer and the workgroup buffer and is expected to release them before returning. When any of the workgroup counts read from the buffer is zero, the function bailed out early and skipped the cleanup, leaking the vaddr mappings of both BOs.
Jump to the cleanup path instead of returning directly, so the mappings are always dropped.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
If your system is affected and you cannot immediately update, audit and monitor for vaddr/graphics memory leaks in drm/v3d (v3d_rewrite_csd_job_wg_counts_from_indirect) and ensure BO/graphics mappings are released even when indirect CSD has zeroed workgroups, since the issue was caused by an early return that skipped cleanup.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53140?
CVE-2026-53140 has a medium severity rating of 5.5 according to CVSS 3.1.
What does CVE-2026-53140 affect?
CVE-2026-53140 affects the Linux kernel, specifically the drm/v3d module.
How do I fix CVE-2026-53140?
To fix CVE-2026-53140, update your Linux kernel to the patched version that addresses this vulnerability.
What types of attacks does CVE-2026-53140 enable?
CVE-2026-53140 enables potential information leakage through vaddr leak when handling indirect CSD with zeroed workgroups.
What is the impact of CVE-2026-53140?
The impact of CVE-2026-53140 is heightened system risk due to a potential leak of memory addresses, but it requires specific conditions to be exploited.