CVE-2026-53190
drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait()
Description
In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() dma_fence_unwrap_for_each() internally calls dma_fence_unwrap_first() which does cursor->chain = dma_fence_get(head), taking an extra reference. On normal loop completion, dma_fence_unwrap_next() releases this via dma_fence_chain_walk() -> dma_fence_put(). When virtio_gpu_do_fence_wait() fails and the function returns early from inside the loop, the cursor->chain reference is never released. This is the only caller in the entire kernel that does an early return inside dma_fence_unwrap_for_each. Add dma_fence_put(itr.chain) before the early return.
INFO
Published Date :
June 25, 2026, 9:16 a.m.
Last Modified :
July 6, 2026, 12:38 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | [email protected] |
Solution
- Add dma_fence_put(itr.chain) before early return.
- Apply the patch to the Linux kernel.
- Update the Linux kernel to a fixed version.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-53190.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-53190 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-53190
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-53190 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-53190 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Jul. 06, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Added CWE NVD-CWE-Other Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.36 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.94 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.0.13 *cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc7:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.5 up to (excluding) 6.6.143 Added Reference Type kernel.org: https://git.kernel.org/stable/c/3f26bb732cc136ab20176697c92f32c9c84cb125 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/73524e9f96a278b521f257a78a845c49eb522bc1 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/8348567a6afb24e2c9cafe8a321162d0eebe1411 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/898bd0ccfed71651b881660c5d20ad73b5203174 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/c0fffc874c264292e769f26194a2a5e66ce31810 Types: Patch -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 25, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'eba57fb5498f2858768321e64570caea188455b8', 'lessThan': '898bd0ccfed71651b881660c5d20ad73b5203174', 'versionType': 'git'}, {'status': 'affected', 'version': 'eba57fb5498f2858768321e64570caea188455b8', 'lessThan': '73524e9f96a278b521f257a78a845c49eb522bc1', 'versionType': 'git'}, {'status': 'affected', 'version': 'eba57fb5498f2858768321e64570caea188455b8', 'lessThan': '8348567a6afb24e2c9cafe8a321162d0eebe1411', 'versionType': 'git'}, {'status': 'affected', 'version': 'eba57fb5498f2858768321e64570caea188455b8', 'lessThan': 'c0fffc874c264292e769f26194a2a5e66ce31810', 'versionType': 'git'}, {'status': 'affected', 'version': 'eba57fb5498f2858768321e64570caea188455b8', 'lessThan': '3f26bb732cc136ab20176697c92f32c9c84cb125', 'versionType': 'git'}], 'programFiles': ['drivers/gpu/drm/virtio/virtgpu_submit.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.5'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.5', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.143', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.94', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.36', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.13', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/gpu/drm/virtio/virtgpu_submit.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() dma_fence_unwrap_for_each() internally calls dma_fence_unwrap_first() which does cursor->chain = dma_fence_get(head), taking an extra reference. On normal loop completion, dma_fence_unwrap_next() releases this via dma_fence_chain_walk() -> dma_fence_put(). When virtio_gpu_do_fence_wait() fails and the function returns early from inside the loop, the cursor->chain reference is never released. This is the only caller in the entire kernel that does an early return inside dma_fence_unwrap_for_each. Add dma_fence_put(itr.chain) before the early return. Added Reference https://git.kernel.org/stable/c/3f26bb732cc136ab20176697c92f32c9c84cb125 Added Reference https://git.kernel.org/stable/c/73524e9f96a278b521f257a78a845c49eb522bc1 Added Reference https://git.kernel.org/stable/c/8348567a6afb24e2c9cafe8a321162d0eebe1411 Added Reference https://git.kernel.org/stable/c/898bd0ccfed71651b881660c5d20ad73b5203174 Added Reference https://git.kernel.org/stable/c/c0fffc874c264292e769f26194a2a5e66ce31810