---
id: CVE-2026-53140
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups

  v3d_rewrite_csd_job_wg_counts_from_indirect() maps both the indirect
  buffer and the workgroup buffer an…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups

  v3d_rewrite_csd_job_wg_counts_from_indirect() maps both the indirect
  buffer and the workgroup buffer an…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-401
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 6.8, < 6.12.94'
  - 'linux_kernel >= 6.13, < 6.18.36'
  - 'linux_kernel >= 6.19, < 7.0.13'
  - linux_kernel = 7.1
patched:
  - linux_kernel 7.0.13
published: '2026-06-25'
updated: '2026-07-06'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53140'
references:
  - url: 'https://git.kernel.org/stable/c/0b59d0946913a0df7d1a033013e259e9b6a76546'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/60ebeb23eaf3d7fd2e0551fe304309305e31d424'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/90b629269088a9fe24a02c032be9f08357f47873'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ae7676952790f421c40918e2586a2c9f12a682b6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.00122
epssPercentile: 0.01722
ingestedAt: '2026-07-06T17:44:51.341Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups

v3d_rewrite_csd_job_wg_counts_from_indirect() maps both the indirect
buffer and the workgroup buffer and is expected to release them before
returning. When any of the workgroup counts read from the buffer is zero,
the function bailed out early and skipped the cleanup, leaking the vaddr
mappings of both BOs.

Jump to the cleanup path instead of returning directly, so the mappings
are always dropped.

## Affected

- `linux_kernel >= 6.8, < 6.12.94`
- `linux_kernel >= 6.13, < 6.18.36`
- `linux_kernel >= 6.19, < 7.0.13`
- `linux_kernel = 7.1`

## Remediation

Upgrade past the affected range:

- `linux_kernel 7.0.13`