CVE-2026-53141: drm/v3d: Fix global performance monitor reference counting
In the Linux kernel, the following vulnerability has been resolved:
drm/v3d: Fix global performance monitor reference counting
In the SETGLOBAL ioctl, v3dperfmonfind() bumps the reference count on the perfmon it returns, but v3dperfmonsetglobalioctl() and v3dperfmondelete() fail to release that reference on several paths:
1. v3dperfmonsetglobalioctl() leaks the reference on its error paths.
2. CLEARGLOBAL leaks both the find reference and the reference previously stashed in v3d->globalperfmon by the SETGLOBAL ioctl that configured it.
3. Destroying a perfmon that is the current global perfmon leaks the reference stashed by the SETGLOBAL ioctl.
Release each of these references explicitly.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Release each of the leaked references explicitly when calling v3d_perfmon_set_global_ioctl() and v3d_perfmon_delete(), ensuring the reference bumped by v3d_perfmon_find() is released on all error paths (the material states releases are needed because SET_GLOBAL ioctl and global perfmon destroy currently fail to release references on several paths).