CVE-2026-53140: Linux DRM v3d Virtual Address Memory Leak

Technical summary

CVE-2026-53140 is a use-after-free/resource leak (CWE-401) in the v3d_rewrite_csd_job_wg_counts_from_indirect() function within the Linux kernel's DRM v3d driver. The function maps both an indirect buffer and a workgroup buffer to read workgroup counts, then should unmap both before returning. However, when any workgroup count read from the indirect buffer is zero, the function returns early without executing the cleanup path, leaving both virtual address mappings allocated. Over repeated invocations with zero workgroup counts, this causes vaddr leak and potential denial of service through kernel memory exhaustion. The fix involves replacing early returns with jumps to an existing cleanup label, ensuring unmapping occurs regardless of workgroup count values.

Business impact

Organizations running Linux systems with GPU compute workloads (particularly those using Mesa or proprietary drivers that consume DRM v3d) face incremental kernel memory exhaustion over time if workloads trigger the zero-workgroup condition. In environments with compute farms, machine learning pipelines, or graphics-intensive services, repeated triggering of this leak can degrade system stability and force periodic reboots. No data confidentiality or integrity impact occurs; the risk is primarily availability. Systems allowing untrusted local users to submit compute jobs are at higher risk.

Affected systems

All Linux kernel versions containing the affected v3d DRM driver code are potentially vulnerable. The v3d driver is commonly found in systems using Broadcom VideoCore GPUs, including Raspberry Pi devices running Linux, embedded systems, and some specialized compute platforms. Desktop and server systems without active GPU compute workloads may see minimal practical impact. The vulnerability requires local code execution capability to trigger, limiting exposure in typical cloud or hardened server environments.

Exploitability

Exploitation requires local access and the ability to submit compute shader dispatch jobs via the DRM interface. The attack is not remote. An unprivileged local user with access to GPU compute APIs (such as through Vulkan or OpenGL compute shaders) can trigger the leak by submitting workloads with zero workgroup counts. No special privileges are required beyond standard GPU access. However, crafting reliable exploitation requires understanding of the driver's indirect CSD submission interface, making opportunistic exploitation less likely than targeted attacks. The CVSS score of 5.5 (MEDIUM, affecting availability only) reflects the local-only attack vector and lack of confidentiality/integrity impact.

Remediation

Patch the Linux kernel to include the fix for v3d_rewrite_csd_job_wg_counts_from_indirect(). Verify that the applied kernel version includes the change converting early returns to cleanup-path jumps. Check kernel changelogs or vendor security advisories for the specific patch version. Interim mitigation includes restricting local GPU access to trusted users only and disabling DRM v3d driver if GPU compute is not required. Monitor systems for unexpected kernel memory consumption tied to GPU workload submission.

Patch guidance

Apply the latest Linux kernel security update from your distribution that includes fixes for DRM v3d memory leaks. Kernel versions released after July 6, 2026 should include this fix. Verify the patch commit references the v3d_rewrite_csd_job_wg_counts_from_indirect() function or mentions the indirect CSD workgroup count cleanup fix. For Raspberry Pi and embedded systems, check the official kernel branch (typically linux-rpi or the foundation's kernel repository) for the corresponding patch. Test in a non-production environment with GPU compute workloads to confirm stability after patching.

Detection guidance

Monitor kernel memory usage over time on systems running GPU compute workloads, particularly those using v3d drivers. Use /proc/meminfo and kernel.slab metrics to track vaddr allocation trends. Enable kernel memory leak detection (KMEMLEAK) in test environments to identify vaddr mapping leaks. Check GPU utilization logs for patterns of zero-workgroup-count submissions. In production, monitor for unexpected out-of-memory conditions correlating with GPU workload submission. Systems should baseline their normal memory usage and alert on sustained upward trends that might indicate the leak being triggered repeatedly.

Why prioritize this

This vulnerability ranks at medium priority for most organizations due to its requirement for local access and impact limited to availability. However, systems explicitly running GPU compute workloads—particularly Raspberry Pi clusters, edge computing deployments, or specialized inference platforms—should prioritize patching because they are most likely to trigger the leak condition. The lack of KEV designation and the narrow attack surface (requires GPU compute API access) suggest active exploitation is currently unlikely, but the cumulative impact of kernel memory exhaustion warrants timely remediation for affected use cases.

Risk score, explained

CVSS 5.5 (MEDIUM) reflects: AV:L (local only, not remote), AC:L (low complexity; triggering requires only submitting a compute job with zero workgroup counts), PR:L (requires local user privileges to access GPU), UI:N (no user interaction needed), S:U (impact contained to the affected system), C:N (no confidentiality impact), I:N (no integrity impact), A:H (high availability impact through resource exhaustion). The score appropriately weights the serious denial-of-service potential against the strict local-access requirement.

Frequently asked questions