Bug 2492723 (CVE-2026-53140)

Summary:	CVE-2026-53140 kernel: drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel's `drm/v3d` driver. This vulnerability occurs because a specific function, `v3d_rewrite_csd_job_wg_counts_from_indirect()`, does not correctly release virtual address mappings under certain conditions, specifically when workgroup counts are zero. This oversight results in a virtual address leak, which could potentially allow an attacker to gain sensitive information about the system's memory configuration.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-06-25 10:02:24 UTC

In the Linux kernel, the following vulnerability has been resolved:

drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups

v3d_rewrite_csd_job_wg_counts_from_indirect() maps both the indirect
buffer and the workgroup buffer and is expected to release them before
returning. When any of the workgroup counts read from the buffer is zero,
the function bailed out early and skipped the cleanup, leaking the vaddr
mappings of both BOs.

Jump to the cleanup path instead of returning directly, so the mappings
are always dropped.

Comment 1 TEJ RATHI 2026-06-26 07:47:18 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026062544-CVE-2026-53140-0525@gregkh/T