CVE-2026-53054

drm/msm: Fix VM_BIND UNMAP locking

Published Jun 24, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/msm: Fix VM_BIND UNMAP locking

Wrong argument meant that the objs involved in UNMAP ops were not always
getting locked.

Since _NO_SHARE objs share a common resv with the VM (which is always
locked) this would only show up with non-_NO_SHARE BOs.

Patchwork: https://patchwork.freedesktop.org/patch/713898/

Analysis

Technical impact

Wrong argument handling in the Linux DRM/msm driver caused non-_NO_SHARE buffer objects to be unbound from the virtual memory map without acquiring the necessary lock. This race condition can allow concurrent access to shared resources, potentially corrupting kernel memory or causing a crash. The vulnerability occurs during UNMAP operations and threatens the integrity of the kernel’s graphics memory management.

Affected Systems

All Linux kernel releases lacking the vm_bind unmap locking fix are affected; the flaw is limited to the DRM/msm driver stack, so any distribution shipping a kernel version without the patch is vulnerable.

Risk and Exploitability

The issue is a race condition that requires privileged kernel context and concurrent unbinding of buffer objects. The CVSS score of 7.8 indicates high severity, and the EPSS score < 1% indicates that exploit probability is low. It is not listed in CISA KEV. Remote exploitation is unlikely, but a local privileged actor or compromised process could induce data corruption or cause a denial-of-service within the kernel. The race condition relates to CWE-413 and CWE-667.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`2e6a8a1fe2b262a6dfd0a65041fcd830ee1e7143`	affected	< 206f812ef140727b75697111391ae320fd8aa652
`2e6a8a1fe2b262a6dfd0a65041fcd830ee1e7143`	affected	< d9ecf758270501b2e7a0bc1dd69a6f28f1ae3cae
`2e6a8a1fe2b262a6dfd0a65041fcd830ee1e7143`	affected	< 85042c2cd970a6b0e686329387096fe19989ae62

Linux

affected

Version	Status	Constraints
`6.17`	affected	—
`0`	unaffected	< 6.17
`6.18.33`	unaffected	≤ 6.18.*
`7.0.10`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[2e6a8a1fe2b262a6dfd0a65041fcd830ee1e7143,206f812ef140727b75697111391ae320fd8aa652)`	affected	code_commit	—
`[2e6a8a1fe2b262a6dfd0a65041fcd830ee1e7143,85042c2cd970a6b0e686329387096fe19989ae62)`	affected	code_commit	—
`[2e6a8a1fe2b262a6dfd0a65041fcd830ee1e7143,d9ecf758270501b2e7a0bc1dd69a6f28f1ae3cae)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.17`	affected	generic	—
`[0,6.17)`	unaffected	generic	—
`[6.18.33,7.0.0)`	unaffected	semver	—
`[7.0.10,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to a Linux kernel that contains the drm/msm vm_bind unmap locking fix.
If an immediate kernel upgrade is not possible, temporarily disable GPU acceleration or restrict usage of the drm/msm driver until the patch is applied.
For systems unable to upgrade or disable GPU workloads, continuously monitor the kernel logs for signs of GPU buffer corruption or crashes and apply the specific commit manually from the vendor’s git tree and rebuild the kernel.

Generated by OpenCVE AI on August 12, 2026 at 06:58 UTC.

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-8566-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8568-1	Linux kernel (OEM) vulnerabilities
Ubuntu USN	USN-8569-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8663-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8664-1	Linux kernel (NVIDIA BaseOS) vulnerabilities
Ubuntu USN	USN-8728-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8728-2	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8728-3	Linux kernel (Oracle) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.134% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/206f812ef140727b75697111391ae320fd8aa652
https://git.kernel.org/stable/c/85042c2cd970a6b0e686329387096fe19989ae62
https://git.kernel.org/stable/c/d9ecf758270501b2e7a0bc1dd69a6f28f1ae3cae
https://lore.kernel.org/linux-cve-announce/2026062400-CVE-2026-53054-4e3b@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-53054
https://www.cve.org/CVERecord?id=CVE-2026-53054

History

Jun 28, 2026 8:00 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Jun 27, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-413
References		https://lore.kernel.org/linux-cve-announce/2026062400-CVE-2026-53054-4e3b@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-53054 https://www.cve.org/CVERecord?id=CVE-2026-53054
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Jun 24, 2026 5:15 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix VM_BIND UNMAP locking Wrong argument meant that the objs involved in UNMAP ops were not always getting locked. Since _NO_SHARE objs share a common resv with the VM (which is always locked) this would only show up with non-_NO_SHARE BOs. Patchwork: https://patchwork.freedesktop.org/patch/713898/
Title		drm/msm: Fix VM_BIND UNMAP locking
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/206f812ef140727b75697111391ae320fd8aa652 https://git.kernel.org/stable/c/85042c2cd970a6b0e686329387096fe19989ae62 https://git.kernel.org/stable/c/d9ecf758270501b2e7a0bc1dd69a6f28f1ae3cae