CVE-2026-53056 Overview
CVE-2026-53056 is a Linux kernel vulnerability in the Qualcomm MSM Display Processing Unit (DPU) driver (drm/msm/dpu). During DPU runtime suspend, the driver calls dev_pm_opp_set_rate(dev, 0), which drops the MMCX power rail to MIN_SVS while leaving the core clock frequency at its original maximum rate. When runtime resume re-enables the clock, the rail voltage no longer matches the clock rate. The mismatch can leave the MMCX rail unable to sustain the configured clock frequency, producing instability or a system crash. The defect affects systems using the Qualcomm MSM DRM driver on Linux kernels containing the dpu_runtime_suspend regression.
Critical Impact
A voltage/frequency mismatch between the MMCX rail and the DPU core clock can cause kernel-level instability or system crashes on affected Qualcomm display hardware.
Affected Products
- Linux kernel — drm/msm/dpu driver
- Systems using Qualcomm MMCX power rail with MSM DPU
- Devices relying on dpu_runtime_suspend/dpu_kms_hw_init paths
Discovery Timeline
- 2026-06-24 - CVE-2026-53056 published to NVD
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-53056
Vulnerability Analysis
The bug stems from a power management ordering issue in the Qualcomm MSM DPU driver. The driver calls dev_pm_opp_set_rate(dev, 0) inside dpu_runtime_suspend to release the Operating Performance Point (OPP) vote. This call drops the MMCX rail voltage to MIN_SVS, but the core clock frequency is not lowered to match. On resume, only the clock is re-enabled, leaving the rail at MIN_SVS while the clock continues to run at its previous maximum rate.
The maintainers describe a concrete race involving the DPU bind path. On CPU 0, dev_sync_state invokes rpmhpd_sync_state, which releases the boot-time guarantee that the MMCX rail remains at its highest performance level. Concurrently on CPU 1, dpu_kms_hw_init executes and calls dev_pm_opp_set_rate(dev, 0). After rpmhpd_sync_state runs, the rail voltage drops, but the clock state is preserved. The DPU then operates outside its supported voltage/frequency envelope.
Root Cause
The root cause is the unconditional call to dev_pm_opp_set_rate(dev, 0) in dpu_runtime_suspend. This OPP reset desynchronizes the MMCX rail voltage from the active core clock rate. The fix removes that call so that the correct OPP vote is preserved when the DPU resumes.
Attack Vector
This is a kernel reliability defect rather than a remotely exploitable flaw. Triggering the condition requires the normal runtime PM suspend/resume sequence on affected Qualcomm hardware. A local workload that causes repeated DPU suspend/resume cycles, or that races with rpmhpd_sync_state, can reach the unsafe state and induce instability or a system crash.
No verified exploitation code is available. See the upstream patch series referenced in the Patchwork submission for the corrected suspend path.
Detection Methods for CVE-2026-53056
Indicators of Compromise
- Unexpected display subsystem hangs, GPU/DPU faults, or kernel panics on Qualcomm SoCs following DPU runtime suspend/resume cycles.
- Kernel log messages referencing dpu_runtime_suspend, dpu_kms_hw_init, or MMCX rail voltage transitions to MIN_SVS before crashes.
- Stability regressions on affected devices after kernel updates that include the regressed dpu_runtime_suspend behavior.
Detection Strategies
- Audit running kernel versions against the fixed commits listed in the stable tree references to identify exposed builds.
- Correlate display-driver crash signatures from dmesg and journalctl across affected Qualcomm devices to surface clustered failures.
- Track DPU power-state transitions through tracefs events (for example, pm_runtime, clk, and OPP events) to identify mismatched voltage/frequency states.
Monitoring Recommendations
- Collect kernel crash dumps and panic logs from fleet devices and forward them to a central log store for analysis.
- Alert on repeated drm/msm/dpu warnings and oops events that follow runtime suspend transitions.
- Monitor patch compliance for the Linux kernel across Qualcomm-based endpoints and embedded systems.
How to Mitigate CVE-2026-53056
Immediate Actions Required
- Apply the upstream Linux kernel fix that removes dev_pm_opp_set_rate(dev, 0) from dpu_runtime_suspend.
- Update affected Qualcomm-based devices to a stable kernel release containing one of the referenced fix commits.
- Inventory devices running the vulnerable drm/msm/dpu driver and prioritize systems exhibiting display-related crashes.
Patch Information
The fix is available in the mainline and stable Linux kernel trees. Refer to the upstream commits: 0ccf4f27b465, 0f7dd5839cfa, 1181a7028d37, 9830999c9e06, bc1dccc518cc, and c5735c7d0eef. The patch removes the offending OPP reset call so the correct vote is restored when the DPU resumes.
Workarounds
- No supported workaround exists short of applying the upstream patch; avoid kernels containing the regressed dpu_runtime_suspend behavior.
- For development or test environments, reduce DPU runtime suspend churn by adjusting autosuspend_delay_ms for the DPU device, recognizing this only reduces exposure and does not eliminate the defect.
# Verify the running kernel and confirm the fix is present
uname -r
git -C /usr/src/linux log --oneline | grep -i "drm/msm/dpu: fix mismatch between power and frequency"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
