UBUNTU-CVE-2026-53139: Medium severity ubuntu/linux-hwe-edge vulnerability

Q: Who is realistically exposed to this issue?

Systems using an affected Ubuntu kernel package with the V3D graphics driver are relevant. Exploitation requires a local low-privileged user able to submit compute shader dispatches through the graphics stack.

Q: What condition triggers the unintended shader execution?

A compute shader dispatch must have a zero workgroup count in at least one dimension. This can occur through an indirect CSD job after its workgroup counts are read from the indirect buffer; the hardware interprets a zero count as 65536 rather than treating it as a no-op.

Q: How can I tell whether a workload may be affected?

Review GPU compute workloads using indirect CSD jobs for workgroup-count buffers that can contain zero in any dimension. Affected behavior is indicated when such a job is submitted to V3D hardware instead of completing immediately as a no-op.

Q: What mitigation is available if an updated kernel cannot be deployed immediately?

Prevent untrusted local users or workloads from submitting V3D compute shader jobs, particularly indirect CSD dispatches. Ensure applications do not submit indirect workgroup counts with zero in any dimension.

Published Jun 25, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Skip CSD when it has zeroed workgroups A compute shader dispatch encodes its workgroup counts in the CFG0..CFG2 registers. Kicking off a dispatch with a zero count in any of the three dimensions is invalid. First, the hardware will process 0 as 65536, while the user-space driver exposes a maximum of 65535. Over that, a submission with a zeroed workgroup dimension should be a no-op. These zeroed counts can reach the dispatch path through an indirect CSD job, whose workgroup counts are only known once the indirect buffer is read and may legitimately be zero, but such scenario should only result in a no-op. Overwrite the indirect CSD job workgroup counts with the indirect BO ones, even if they are zeroed, and don't submit the job to the hardware when any of the workgroup counts is zero, so the job completes immediately instead of running the shader.

Affected Software

236 affected componentsFixes available

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-aws-5.4*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-5.4*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gcp-5.4*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-5.4*

ubuntu/linux-hwe-edge*

ubuntu/linux-ibm-5.4*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-oracle-5.4*

ubuntu/linux-raspi-5.4*

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.15<5.15.0-1117.124~20.04.1

5.15.0-1117.124~20.04.1

ubuntu/linux-aws-5.8*

ubuntu/linux-azure*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.15<5.15.0-1123.132~20.04.1

5.15.0-1123.132~20.04.1

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-azure-fde-5.15<5.15.0-1122.131~20.04.1

5.15.0-1122.131~20.04.1

ubuntu/linux-bluefield*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.15<5.15.0-1118.128~20.04.1

5.15.0-1118.128~20.04.1

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.15<5.15.0-198.208~20.04.1

5.15.0-198.208~20.04.1

ubuntu/linux-hwe-5.8*

ubuntu/linux-ibm*

ubuntu/linux-ibm-5.15<5.15.0-1111.115~20.04.1

5.15.0-1111.115~20.04.1

ubuntu/linux-intel-5.13*

ubuntu/linux-intel-iotg-5.15<5.15.0-1112.118~20.04.1

5.15.0-1112.118~20.04.1

ubuntu/linux-iot*

ubuntu/linux-kvm*

ubuntu/linux-lowlatency-hwe-5.15<5.15.0-195.205~20.04.1

5.15.0-195.205~20.04.1

ubuntu/linux-nvidia-tegra-5.15*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.15<5.15.0-1114.120~20.04.1

5.15.0-1114.120~20.04.1

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.15<5.15.0-1111.115~20.04.1

5.15.0-1111.115~20.04.1

ubuntu/linux-riscv-5.8*

ubuntu/linux-xilinx-zynqmp*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<5.15.0-198.208

5.15.0-198.208

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws<5.15.0-1117.124

5.15.0-1117.124

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-aws-6.8*

ubuntu/linux-azure<5.15.0-1123.132

5.15.0-1123.132

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-6.8*

ubuntu/linux-azure-fde<5.15.0-1122.131

5.15.0-1122.131

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-azure-fde-6.8*

ubuntu/linux-gcp<5.15.0-1118.128

5.15.0-1118.128

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gcp-6.8*

ubuntu/linux-gke<5.15.0-1113.119

5.15.0-1113.119

ubuntu/linux-gkeop<5.15.0-1100.108

5.15.0-1100.108

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-ibm<5.15.0-1111.115

5.15.0-1111.115

ubuntu/linux-ibm-6.8*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-intel-iotg<5.15.0-1112.118

5.15.0-1112.118

ubuntu/linux-kvm<5.15.0-1109.114

5.15.0-1109.114

ubuntu/linux-lowlatency<5.15.0-195.205

5.15.0-195.205

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-lowlatency-hwe-6.8*

ubuntu/linux-nvidia<5.15.0-1112.113

5.15.0-1112.113

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-nvidia-6.8*

ubuntu/linux-nvidia-tegra*

ubuntu/linux-nvidia-tegra-igx*

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle<5.15.0-1114.120

5.15.0-1114.120

ubuntu/linux-oracle-6.5*

ubuntu/linux-oracle-6.8*

ubuntu/linux-raspi*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-riscv-6.8*

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-xilinx-zynqmp<5.15.0-1080.84

5.15.0-1080.84

ubuntu/linux-bluefield<5.15.0-1101.103

5.15.0-1101.103

ubuntu/linux-intel-iot-realtime<5.15.0-1109.111

5.15.0-1109.111

ubuntu/linux-realtime<5.15.0-1116.125

5.15.0-1116.125

ubuntu/linux-realtime-6.8*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips<5.15.0-1117.124+fips1

5.15.0-1117.124+fips1

ubuntu/linux-azure-fips<5.15.0-1123.132+fips1

5.15.0-1123.132+fips1

ubuntu/linux-fips<5.15.0-198.208+fips1

5.15.0-198.208+fips1

ubuntu/linux-gcp-fips<5.15.0-1118.128+fips1

5.15.0-1118.128+fips1

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-aws-6.14*

ubuntu/linux-aws-6.17*

ubuntu/linux-aws-7.0<7.0.0-1012.12~24.04.1

7.0.0-1012.12~24.04.1

ubuntu/linux-azure*

ubuntu/linux-azure-6.11*

ubuntu/linux-azure-6.14*

ubuntu/linux-azure-6.17*

ubuntu/linux-azure-7.0<7.0.0-1014.14~24.04.1

7.0.0-1014.14~24.04.1

ubuntu/linux-azure-fde*

ubuntu/linux-azure-fde-6.14*

ubuntu/linux-azure-fde-6.17*

ubuntu/linux-azure-fde-7.0<7.0.0-1013.13~24.04.1

7.0.0-1013.13~24.04.1

ubuntu/linux-azure-nvidia*

ubuntu/linux-azure-nvidia-6.14*

ubuntu/linux-gcp*

ubuntu/linux-gcp-6.11*

ubuntu/linux-gcp-6.14*

ubuntu/linux-gcp-7.0<7.0.0-1011.11~24.04.1

7.0.0-1011.11~24.04.1

ubuntu/linux-gke*

ubuntu/linux-gkeop*

ubuntu/linux-hwe-6.11*

ubuntu/linux-hwe-6.14*

ubuntu/linux-hwe-6.17*

ubuntu/linux-hwe-7.0<7.0.0-31.31~24.04.1

7.0.0-31.31~24.04.1

ubuntu/linux-ibm*

ubuntu/linux-lowlatency*

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-nvidia*

ubuntu/linux-nvidia-6.11*

ubuntu/linux-nvidia-6.17*

ubuntu/linux-nvidia-7.0<7.0.0-1018.18~24.04.1

7.0.0-1018.18~24.04.1

ubuntu/linux-nvidia-lowlatency*

ubuntu/linux-nvidia-tegra*

ubuntu/linux-oem-6.11*

ubuntu/linux-oem-6.14*

ubuntu/linux-oem-6.17*

ubuntu/linux-oem-6.8*

ubuntu/linux-oracle*

ubuntu/linux-oracle-6.14*

ubuntu/linux-oracle-6.17*

ubuntu/linux-oracle-7.0<7.0.0-1011.11~24.04.1

7.0.0-1011.11~24.04.1

ubuntu/linux-raspi*

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-6.14*

ubuntu/linux-riscv-6.17*

ubuntu/linux-riscv-7.0<7.0.0-31.31.1~24.04.1

7.0.0-31.31.1~24.04.1

ubuntu/linux-vmware*

ubuntu/linux-xilinx*

ubuntu/linux-bluefield*

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-realtime-6.14*

ubuntu/linux-realtime-6.17*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-azure*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp*

ubuntu/linux-oracle*

ubuntu/linux-raspi*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux<7.0.0-31.31

7.0.0-31.31

ubuntu/linux-aws<7.0.0-1012.12

7.0.0-1012.12

ubuntu/linux-azure<7.0.0-1014.14

7.0.0-1014.14

ubuntu/linux-azure-fde<7.0.0-1013.13

7.0.0-1013.13

ubuntu/linux-gcp<7.0.0-1011.11

7.0.0-1011.11

ubuntu/linux-gke<7.0.0-1006.7

7.0.0-1006.7

ubuntu/linux-ibm<7.0.0-1013.13

7.0.0-1013.13

ubuntu/linux-nvidia<7.0.0-1018.18

7.0.0-1018.18

ubuntu/linux-nvidia-bos<7.0.0-2018.18

7.0.0-2018.18

ubuntu/linux-oem-7.0<7.0.0-1013.13

7.0.0-1013.13

ubuntu/linux-oracle<7.0.0-1011.11

7.0.0-1011.11

ubuntu/linux-raspi<7.0.0-1019.19

7.0.0-1019.19

ubuntu/linux-realtime<7.0.0-31.31.1

7.0.0-31.31.1

ubuntu/linux-riscv<7.0.0-31.31.1

7.0.0-31.31.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-aws-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1117.124~20.04.1
Upgrade
Upgrade ubuntu/linux-azure-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1123.132~20.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1122.131~20.04.1
Upgrade
Upgrade ubuntu/linux-gcp-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1118.128~20.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-198.208~20.04.1
Upgrade
Upgrade ubuntu/linux-ibm-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1111.115~20.04.1
Upgrade
Upgrade ubuntu/linux-intel-iotg-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1112.118~20.04.1
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-195.205~20.04.1
Upgrade
Upgrade ubuntu/linux-oracle-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1114.120~20.04.1
Upgrade
Upgrade ubuntu/linux-riscv-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1111.115~20.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.15.0-198.208
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.15.0-1117.124
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.15.0-1123.132
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 5.15.0-1122.131
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.15.0-1118.128
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 5.15.0-1113.119
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 5.15.0-1100.108
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 5.15.0-1111.115
Upgrade
Upgrade ubuntu/linux-intel-iotg to a version that resolves this vulnerability.
Fixed in 5.15.0-1112.118
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.15.0-1109.114
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 5.15.0-195.205
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 5.15.0-1112.113
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.15.0-1114.120
Upgrade
Upgrade ubuntu/linux-xilinx-zynqmp to a version that resolves this vulnerability.
Fixed in 5.15.0-1080.84
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 5.15.0-1101.103
Upgrade
Upgrade ubuntu/linux-intel-iot-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1109.111
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1116.125
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1117.124+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1123.132+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-198.208+fips1
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1118.128+fips1
Upgrade
Upgrade ubuntu/linux-aws-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1012.12~24.04.1
Upgrade
Upgrade ubuntu/linux-azure-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1014.14~24.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1013.13~24.04.1
Upgrade
Upgrade ubuntu/linux-gcp-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1011.11~24.04.1
Upgrade
Upgrade ubuntu/linux-hwe-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-31.31~24.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1018.18~24.04.1
Upgrade
Upgrade ubuntu/linux-oracle-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1011.11~24.04.1
Upgrade
Upgrade ubuntu/linux-riscv-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-31.31.1~24.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 7.0.0-31.31
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 7.0.0-1012.12
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 7.0.0-1014.14
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 7.0.0-1013.13
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 7.0.0-1011.11
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 7.0.0-1006.7
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 7.0.0-1013.13
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 7.0.0-1018.18
Upgrade
Upgrade ubuntu/linux-nvidia-bos to a version that resolves this vulnerability.
Fixed in 7.0.0-2018.18
Upgrade
Upgrade ubuntu/linux-oem-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1013.13
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 7.0.0-1011.11
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 7.0.0-1019.19
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 7.0.0-31.31.1
Upgrade
Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.
Fixed in 7.0.0-31.31.1
Compensating control
For indirect CSD jobs, overwrite the workgroup counts with the indirect buffer object's counts, including zero values, and do not submit the job to hardware when any of the three workgroup counts is zero; complete the job immediately as a no-op.

Event History

Jun 25, 2026

CVE Published

via OSV·09:16 AM

Data Sourced

via OSV·09:16 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is realistically exposed to this issue?

Systems using an affected Ubuntu kernel package with the V3D graphics driver are relevant. Exploitation requires a local low-privileged user able to submit compute shader dispatches through the graphics stack.

What condition triggers the unintended shader execution?

A compute shader dispatch must have a zero workgroup count in at least one dimension. This can occur through an indirect CSD job after its workgroup counts are read from the indirect buffer; the hardware interprets a zero count as 65536 rather than treating it as a no-op.

How can I tell whether a workload may be affected?

Review GPU compute workloads using indirect CSD jobs for workgroup-count buffers that can contain zero in any dimension. Affected behavior is indicated when such a job is submitted to V3D hardware instead of completing immediately as a no-op.

What mitigation is available if an updated kernel cannot be deployed immediately?

Prevent untrusted local users or workloads from submitting V3D compute shader jobs, particularly indirect CSD dispatches. Ensure applications do not submit indirect workgroup counts with zero in any dimension.

UBUNTU-CVE-2026-53139: Medium severity ubuntu/linux-hwe-edge vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is realistically exposed to this issue?

What condition triggers the unintended shader execution?

How can I tell whether a workload may be affected?

What mitigation is available if an updated kernel cannot be deployed immediately?

Company

Resources

Contact