CVE-2026-53190
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
36/100
Published: 2026-06-25
Modified: 2026-11-06
First seen: 2026-11-06
Status: active
Attack Surface
Low Complexity
No Interaction
CVSS Vector Breakdown
AV:
Local
AC:
Low
PR:
Low
UI:
None
S:
Unchanged
C:
None
I:
None
A:
High
Description
In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() dma_fence_unwrap_for_each() internally calls dma_fence_unwrap_first() which does cursor->chain = dma_fence_get(head), taking an extra reference. On normal loop completion, dma_fence_unwrap_next() releases this via dma_fence_chain_walk() -> dma_fence_put(). When virtio_gpu_do_fence_wait() fails and the function returns early from inside the loop, the cursor->chain reference is never released. This is the only caller in the entire kernel that does an early return inside dma_fence_unwrap_for_each. Add dma_fence_put(itr.chain) before the early return.
Affected Software (14)
| Vendor | Product | Version |
|---|---|---|
| Linux | Linux | eba57fb5498f2858768321e64570caea188455b8 < 898bd0ccfed71651b881660c5d20ad73b5203174 |
| Linux | Linux | eba57fb5498f2858768321e64570caea188455b8 < 73524e9f96a278b521f257a78a845c49eb522bc1 |
| Linux | Linux | eba57fb5498f2858768321e64570caea188455b8 < 8348567a6afb24e2c9cafe8a321162d0eebe1411 |
| Linux | Linux | eba57fb5498f2858768321e64570caea188455b8 < c0fffc874c264292e769f26194a2a5e66ce31810 |
| Linux | Linux | eba57fb5498f2858768321e64570caea188455b8 < 3f26bb732cc136ab20176697c92f32c9c84cb125 |
| Linux | Linux | 6.5 |
| linux | linux_kernel | 6.5 – 6.6.143 |
| linux | linux_kernel | 7.1 |
| linux | linux_kernel | 7.1 |
| linux | linux_kernel | 7.1 |
| linux | linux_kernel | 7.1 |
| linux | linux_kernel | 7.1 |
| linux | linux_kernel | 7.1 |
| linux | linux_kernel | 7.1 |