CVE-2026-53347: Linux virtio-gpu Driver Crash on Removal Without KMS

Technical summary

CVE-2026-53347 is a use-after-free or uninitialized data access vulnerability in the DRM (Direct Rendering Manager) virtio-gpu driver. The issue occurs in the driver removal/unbinding path when the kernel is compiled with CONFIG_DRM_VIRTIO_GPU_KMS disabled. The atomic modesetting subsystem is conditional on KMS being enabled, but the shutdown sequence in the driver removal handler does not check this condition before attempting to clean up atomic core structures. This results in dereferencing uninitialized pointers, triggering a kernel panic. The vulnerability is classified under CWE-908 (Use of Uninitialized Resource).

Business impact

Systems running virtualized workloads on QEMU or other hypervisors using virtio-gpu without KMS will experience kernel crashes during driver unload events, such as device hot-removal, module unloading, or system shutdown. This causes unexpected downtime and disrupts containerized or VM-based services. In environments with automated driver reloading or frequent device reconfiguration, the crash becomes a reliable denial-of-service vector.

Affected systems

The Linux kernel across all versions is affected. The vulnerability specifically impacts systems with a custom or embedded kernel configuration where virtio-gpu is enabled but DRM_VIRTIO_GPU_KMS is disabled. This is uncommon in standard distributions but more likely in minimal cloud images, embedded systems, or custom hypervisor setups. Affected vendors: Linux (Linux kernel).

Exploitability

Exploitability is low in practice due to the specific configuration requirement. An attacker requires local access and the ability to trigger driver removal—typically via module unload commands, device hot-plug operations, or system reboot. No network vector exists. The vulnerability cannot be triggered remotely on standard distributions where KMS is enabled by default. However, in affected minimal or embedded configurations, any local user or service with root privileges can reliably crash the kernel by unloading the driver.

Remediation

The fix involves adding a conditional check in the driver removal handler to skip atomic core shutdown when KMS is not compiled in. This prevents the code from accessing uninitialized structures. The patch is straightforward and has minimal performance or compatibility impact. End users should update to a patched kernel version from their distribution; verify against your vendor's Linux kernel advisory for specific release versions and patch dates.

Patch guidance

Check your kernel version and rebuild or update to a patched release. If you are running a custom-compiled kernel with virtio-gpu enabled, either enable CONFIG_DRM_VIRTIO_GPU_KMS in your kernel config (recommended) or apply the upstream fix to the virtio-gpu driver removal logic. Distributions should issue kernel updates; monitor your vendor's security advisories (Red Hat, Canonical, etc.) for patched kernel versions. A kernel reboot is required to deploy the fix.

Detection guidance

Monitor system logs for kernel panics or oops messages referencing 'virtio_gpu' or 'drm' in the call stack during driver unload or system shutdown. If using virtualized infrastructure, log driver removal events and correlate with unexpected reboots. Inspect running kernel configuration via /boot/config-* or 'cat /proc/config.gz | zcat' to confirm if CONFIG_DRM_VIRTIO_GPU_KMS is disabled; this indicates a potentially vulnerable configuration. In CI/CD or hypervisor environments, test driver unload sequences in staging to surface crashes before production deployment.

Why prioritize this

Although the CVSS score is medium (5.5), this vulnerability has narrow blast radius due to configuration specificity. Prioritize if you operate minimal or custom-compiled kernels with virtio-gpu but no KMS, or if you manage hypervisor infrastructure where automatic driver reloading occurs. Lower priority for standard Linux distributions where KMS is enabled by default.

Risk score, explained

The CVSS:3.1 score of 5.5 reflects a local attack vector (AV:L), low complexity (AC:L), low privilege requirement (PR:L), no user interaction (UI:N), and no confidentiality or integrity impact—only availability (A:H). The score accurately reflects the impact (reliable kernel crash) and the low likelihood of exploitation in mainstream environments, balanced against the ease of triggering the crash once the narrow configuration requirement is met.

Frequently asked questions