CVE-2026-53139
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
25/06/2026
Last modified:
06/07/2026
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
drm/v3d: Skip CSD when it has zeroed workgroups<br />
<br />
A compute shader dispatch encodes its workgroup counts in the CFG0..CFG2<br />
registers. Kicking off a dispatch with a zero count in any of the three<br />
dimensions is invalid. First, the hardware will process 0 as 65536,<br />
while the user-space driver exposes a maximum of 65535. Over that, a<br />
submission with a zeroed workgroup dimension should be a no-op.<br />
<br />
These zeroed counts can reach the dispatch path through an indirect CSD<br />
job, whose workgroup counts are only known once the indirect buffer is<br />
read and may legitimately be zero, but such scenario should only result in<br />
a no-op.<br />
<br />
Overwrite the indirect CSD job workgroup counts with the indirect BO<br />
ones, even if they are zeroed, and don&#39;t submit the job to the hardware<br />
when any of the workgroup counts is zero, so the job completes immediately<br />
instead of running the shader.
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.3 (including) | 5.15.211 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.16 (including) | 6.1.177 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.2 (including) | 6.6.144 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.7 (including) | 6.12.95 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.13 (including) | 6.18.36 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.19 (including) | 7.0.13 (excluding) |
| cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- https://git.kernel.org/stable/c/11e6432836394e00d39e468cd514f9ddb66f1e49
- https://git.kernel.org/stable/c/7f93fad5ea0affc9e1505dd0f7596c0fdb496213
- https://git.kernel.org/stable/c/8b51c5406ad748c3d5575b66b6009b5dbbc08b80
- https://git.kernel.org/stable/c/9655b56b6de918e1c22b92f3880ae41b052cbd00
- https://git.kernel.org/stable/c/abb069fdf51a9ddabcc1ed125dafe54e2089900b
- https://git.kernel.org/stable/c/ad166139d123dc162e8636f0c7962516d04074e1
- https://git.kernel.org/stable/c/b3a8dd72b0d008ff142880b4dbe5ca37dcf962b4



