CVE-2026-53141: drm/v3d: Fix global performance monitor reference counting
In the Linux kernel, the following vulnerability has been resolved:
drm/v3d: Fix global performance monitor reference counting
In the SETGLOBAL ioctl, v3dperfmonfind() bumps the reference count on the perfmon it returns, but v3dperfmonsetglobalioctl() and v3dperfmondelete() fail to release that reference on several paths:
1. v3dperfmonsetglobalioctl() leaks the reference on its error paths.
2. CLEARGLOBAL leaks both the find reference and the reference previously stashed in v3d->globalperfmon by the SETGLOBAL ioctl that configured it.
3. Destroying a perfmon that is the current global perfmon leaks the reference stashed by the SETGLOBAL ioctl.
Release each of these references explicitly.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Release each of the leaked references explicitly when calling v3d_perfmon_set_global_ioctl() and v3d_perfmon_delete(), ensuring the reference bumped by v3d_perfmon_find() is released on all error paths (the material states releases are needed because SET_GLOBAL ioctl and global perfmon destroy currently fail to release references on several paths).
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The CVSS vector indicates local access with low privileges is required. No user interaction is required.
What is the expected security impact?
The issue is rated as having high availability impact, with no confidentiality or integrity impact. The underlying flaw is unreleased performance-monitor references that can accumulate on affected paths.
Which operations are associated with the reference leaks?
Leaks occur on error paths in SET_GLOBAL, when CLEAR_GLOBAL is used, and when a performance monitor that is currently configured as global is destroyed.