PT-2026-52286 · Linux · Linux

Published 2026-06-25 · Updated 2026-06-25 · CVE-2026-53190

Mitre

In the Linux kernel, the following vulnerability has been resolved:

drm/virtio: fix dma fence refcount leak on error in virtio gpu dma fence wait()

dma fence unwrap for each() internally calls dma fence unwrap first() which does cursor->chain = dma fence get(head), taking an extra reference. On normal loop completion, dma fence unwrap next() releases this via dma fence chain walk() -> dma fence put().

When virtio gpu do fence wait() fails and the function returns early from inside the loop, the cursor->chain reference is never released. This is the only caller in the entire kernel that does an early return inside dma fence unwrap for each.

Add dma fence put(itr.chain) before the early return.

Related Identifiers

CVE-2026-53190

Affected Products

Linux

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-53190 · Security Note
• https://git.kernel.org/stable/c/73524e9f96a278b521f257a78a845c49eb522bc1 · Note
• https://git.kernel.org/stable/c/3f26bb732cc136ab20176697c92f32c9c84cb125 · Note
• https://git.kernel.org/stable/c/8348567a6afb24e2c9cafe8a321162d0eebe1411 · Note
• https://git.kernel.org/stable/c/898bd0ccfed71651b881660c5d20ad73b5203174 · Note
• https://git.kernel.org/stable/c/c0fffc874c264292e769f26194a2a5e66ce31810 · Note