CVE-2026-53054 (GCVE-0-2026-53054)

Vulnerability from cvelistv5 – Published: 2026-06-24 16:29 – Updated: 2026-08-05 12:32
VLAI
Title
drm/msm: Fix VM_BIND UNMAP locking
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix VM_BIND UNMAP locking Wrong argument meant that the objs involved in UNMAP ops were not always getting locked. Since _NO_SHARE objs share a common resv with the VM (which is always locked) this would only show up with non-_NO_SHARE BOs. Patchwork: https://patchwork.freedesktop.org/patch/713898/
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 2e6a8a1fe2b262a6dfd0a65041fcd830ee1e7143 , < 206f812ef140727b75697111391ae320fd8aa652 (git)
Affected: 2e6a8a1fe2b262a6dfd0a65041fcd830ee1e7143 , < d9ecf758270501b2e7a0bc1dd69a6f28f1ae3cae (git)
Affected: 2e6a8a1fe2b262a6dfd0a65041fcd830ee1e7143 , < 85042c2cd970a6b0e686329387096fe19989ae62 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.17
Unaffected: 0 , < 6.17 (semver)
Unaffected: 6.18.33 , ≤ 6.18.* (semver)
Unaffected: 7.0.10 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/msm/msm_gem_vma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "206f812ef140727b75697111391ae320fd8aa652",
              "status": "affected",
              "version": "2e6a8a1fe2b262a6dfd0a65041fcd830ee1e7143",
              "versionType": "git"
            },
            {
              "lessThan": "d9ecf758270501b2e7a0bc1dd69a6f28f1ae3cae",
              "status": "affected",
              "version": "2e6a8a1fe2b262a6dfd0a65041fcd830ee1e7143",
              "versionType": "git"
            },
            {
              "lessThan": "85042c2cd970a6b0e686329387096fe19989ae62",
              "status": "affected",
              "version": "2e6a8a1fe2b262a6dfd0a65041fcd830ee1e7143",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/msm/msm_gem_vma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "lessThan": "6.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.33",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.10",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm: Fix VM_BIND UNMAP locking\n\nWrong argument meant that the objs involved in UNMAP ops were not always\ngetting locked.\n\nSince _NO_SHARE objs share a common resv with the VM (which is always\nlocked) this would only show up with non-_NO_SHARE BOs.\n\nPatchwork: https://patchwork.freedesktop.org/patch/713898/"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached through the DRM MSM VM_BIND ioctl on a local render/device node, not through network or adjacent/physical input.\nAC:L - The attacker controls the ioctl sequence, VM_BIND opt-in, submitqueue creation, mapped BOs, and crafted UNMAP range; the missed locking is directly selected by attacker-controlled fields and any needed concurrency can be created locally.\nPR:L - The ioctl is DRM_RENDER_ALLOW and has no capability check, but the attacker must be a local user/process with access to the MSM DRM render device.\nUI:N - No victim action is required once the attacker can issue the local DRM ioctls.\nS:U - This is a kernel DRM/GPUVM locking flaw whose likely consequences remain within the same kernel security authority; it is not a guest-to-host escape or direct IOMMU boundary bypass.\nC:H - Missing reservation locking around UNMAP/remap can race GPUVA list operations and VMA freeing for shareable BOs, creating use-after-free/list-corruption conditions that can be leveraged for kernel memory disclosure.\nI:H - The same unsynchronized GPUVM/GEM list manipulation and freed-object reuse can plausibly provide kernel memory corruption suitable for arbitrary write or control-flow compromise.\nA:H - The bug can corrupt kernel GPUVM/GEM metadata or trigger use-after-free/oops conditions from local ioctls, leading to a kernel crash or hang."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:32:58.323Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/206f812ef140727b75697111391ae320fd8aa652"
        },
        {
          "url": "https://git.kernel.org/stable/c/d9ecf758270501b2e7a0bc1dd69a6f28f1ae3cae"
        },
        {
          "url": "https://git.kernel.org/stable/c/85042c2cd970a6b0e686329387096fe19989ae62"
        }
      ],
      "title": "drm/msm: Fix VM_BIND UNMAP locking",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53054",
    "datePublished": "2026-06-24T16:29:59.982Z",
    "dateReserved": "2026-06-09T07:44:35.381Z",
    "dateUpdated": "2026-08-05T12:32:58.323Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-53054",
      "date": "2026-10-02",
      "epss": "0.00134",
      "percentile": "0.02427"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/msm/msm_gem_vma.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "206f812ef140727b75697111391ae320fd8aa652",
                    "status": "affected",
                    "version": "2e6a8a1fe2b262a6dfd0a65041fcd830ee1e7143",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d9ecf758270501b2e7a0bc1dd69a6f28f1ae3cae",
                    "status": "affected",
                    "version": "2e6a8a1fe2b262a6dfd0a65041fcd830ee1e7143",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "85042c2cd970a6b0e686329387096fe19989ae62",
                    "status": "affected",
                    "version": "2e6a8a1fe2b262a6dfd0a65041fcd830ee1e7143",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/msm/msm_gem_vma.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.17"
                  },
                  {
                    "lessThan": "6.17",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.33",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.10",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4F0E1027-1081-4E2B-9D56-AF79BAFF146B",
                    "versionEndExcluding": "6.18.33",
                    "versionStartIncluding": "6.17",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A13475D2-59BF-4716-94B5-7C1D239A2CF4",
                    "versionEndExcluding": "7.0.10",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm: Fix VM_BIND UNMAP locking\n\nWrong argument meant that the objs involved in UNMAP ops were not always\ngetting locked.\n\nSince _NO_SHARE objs share a common resv with the VM (which is always\nlocked) this would only show up with non-_NO_SHARE BOs.\n\nPatchwork: https://patchwork.freedesktop.org/patch/713898/"
          }
        ],
        "id": "CVE-2026-53054",
        "lastModified": "2026-07-21T17:24:23.777",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-06-24T17:17:17.430",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/206f812ef140727b75697111391ae320fd8aa652"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/85042c2cd970a6b0e686329387096fe19989ae62"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d9ecf758270501b2e7a0bc1dd69a6f28f1ae3cae"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-667"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T14:36:39+00:00",
      "cve": "CVE-2026-53054",
      "id": "CVE-2026-53054",
      "initial_release_date": "2026-06-24T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/msm: Fix VM_BIND UNMAP locking",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53054.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.