CVE-2026-53054: Linux Kernel msm DRM VM_BIND Locking Vulnerability – Local Privilege Escalation

Technical summary

CVE-2026-53054 is a synchronization vulnerability in the msm DRM driver's VM_BIND UNMAP code path. The bug involves an incorrect argument passed during buffer object (BO) locking in unmap operations, causing non-_NO_SHARE BOs to remain unprotected against concurrent access. Buffer objects marked with the _NO_SHARE flag inherit the virtual machine's reservation object (resv), which is always locked during VM operations, masking the defect for that subset. However, standard BOs lack this implicit protection and are exposed to race conditions when UNMAP operations proceed without proper locking. This violates CWE-667 (improper locking) and allows unprivileged local code to manipulate GPU memory state unsafely.

Business impact

This vulnerability affects any system running a vulnerable Linux kernel with active GPU compute or graphics workloads. The immediate risks include GPU memory corruption, data exfiltration from GPU-accessible memory regions, denial of service through GPU hangs, and potential privilege escalation if sensitive data or kernel pointers are exposed. For organizations deploying GPU-accelerated AI/ML pipelines, cryptocurrency mining, or graphics-intensive applications on multi-tenant Linux systems, the local attack surface is significant. The HIGH CVSS score reflects the combination of user-level exploitation capability and high impact on confidentiality, integrity, and availability.

Affected systems

The Linux kernel is affected, specifically systems with Qualcomm Adreno GPUs using the msm DRM driver. This includes many mobile devices, some edge AI appliances, and Linux systems with compatible Qualcomm GPUs. The vulnerability requires local access (no network vector), so exposure is primarily to scenarios involving shared system access, container escape, or supply-chain compromise of pre-installed kernels. Any distribution shipping an affected kernel version is in scope until patching.

Exploitability

Exploitation requires local (L) access with low privilege (L), no user interaction (N), and affects only the user's own security context (U). While no public exploit is tracked in the KEV catalog and the vulnerability does not appear to be publicly weaponized, the simplicity of the bug—a wrong locking argument—suggests researchers could develop a proof-of-concept that triggers the race condition through GPU API calls (e.g., DRM IOCTL VM_BIND commands). The barrier to exploitation is moderate; an attacker needs familiarity with GPU memory semantics and timing precision, but not exceptional skill.

Remediation

Apply the Linux kernel patch referenced in the Freedesktop Patchwork entry (https://patchwork.freedesktop.org/patch/713898/). Verify with your Linux distribution or kernel vendor for the specific patched kernel version that includes this fix. Systems should prioritize kernel updates, particularly for distributions serving multi-tenant or untrusted-user environments. In the interim, GPU workload isolation and access control (e.g., via cgroups, SELinux, or AppArmor) can reduce the attack surface.

Patch guidance

Patches should be available through your distribution's kernel update mechanism or from kernel.org. Verify against the vendor advisory to confirm the exact version containing the fix. Testing should focus on GPU stability and memory integrity under concurrent workload scenarios. Rollout should follow standard change control, with particular attention to GPU driver compatibility if running out-of-tree drivers.

Detection guidance

Look for unusual patterns of VM_BIND UNMAP IOCTLs from unprivileged processes, particularly in rapid succession or with atypical buffer object configurations. GPU error logs (dmesg, GPU firmware logs) may show memory faults, timeouts, or hang events if exploitation is occurring. Kernel audit logs can track IOCTL frequencies per process. EDR/kernel monitoring should alert on GPU memory corruption indicators or GPU-related privilege escalation attempts.

Why prioritize this

Although not yet tracked as exploited in the wild (KEV status: false), this is a HIGH-severity local privilege escalation vector affecting a commonly used kernel component. Patching is straightforward once identified and poses minimal regression risk. Multi-tenant systems, cloud providers offering bare-metal GPU instances, and organizations with untrusted user populations should prioritize this above most medium-severity vulnerabilities.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects: local attack vector (AV:L), low complexity (AC:L), low privilege requirement (PR:L), no user interaction (UI:N), unchanged scope (S:U), and high impact across confidentiality, integrity, and availability (C:H, I:H, A:H). The score appropriately penalizes the lack of authentication barrier and the severity of memory corruption potential, balanced against the local-only requirement.

Frequently asked questions