CVE-2026-53139 Overview
CVE-2026-53139 affects the Linux kernel drm/v3d Direct Rendering Manager (DRM) driver, which supports the Broadcom VideoCore VI GPU used in Raspberry Pi devices. The flaw resides in the compute shader dispatch (CSD) path, where workgroup counts encoded in the CFG0..CFG2 registers can be zero when sourced from an indirect buffer object (BO). The hardware interprets a zero workgroup count as 65536, exceeding the maximum of 65535 exposed by the user-space driver. Submitting such jobs leads to incorrect GPU behavior instead of a no-op. The Linux kernel maintainers resolved the issue by overwriting indirect CSD job workgroup counts with the indirect BO values and skipping hardware submission when any workgroup count is zero.
Critical Impact
Indirect compute shader dispatches with zeroed workgroup counts trigger unintended GPU execution paths rather than completing as a no-op, leading to potential GPU state corruption or incorrect kernel-level handling on affected systems.
Affected Products
- Linux kernel drm/v3d driver supporting the Broadcom VideoCore VI GPU
- Linux distributions running affected kernel versions on Raspberry Pi 4/5 and similar VC6-based hardware
- Embedded systems using the v3d DRM driver for compute shader workloads
Discovery Timeline
- 2026-06-25 - CVE-2026-53139 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-53139
Vulnerability Analysis
The vulnerability stems from how the v3d DRM driver dispatches compute shader jobs to the Broadcom V3D GPU. A compute shader dispatch encodes its workgroup counts across three dimensions in the CFG0, CFG1, and CFG2 registers. The user-space driver enforces a maximum value of 65535 per dimension. However, the underlying hardware treats a register value of 0 as 65536, creating a mismatch between the documented user-space limit and the actual hardware behavior.
This edge case becomes reachable through indirect CSD jobs. Indirect dispatches read workgroup counts from an indirect buffer object at submission time, meaning the values are unknown when the job is queued and may legitimately be zero. Without the fix, a zero count flows directly to the hardware registers and executes 65536 workgroups instead of producing a no-op as expected.
Root Cause
The root cause is missing validation of indirect workgroup counts in the CSD submission path. The driver did not propagate the indirect BO workgroup values into the job structure before dispatch, nor did it short-circuit submission when any dimension equaled zero. The fix overwrites the indirect CSD job workgroup counts with the values read from the indirect BO, even when zero, and bypasses the hardware kick when any dimension is zero so the job completes immediately.
Attack Vector
A local user with access to the /dev/dri/renderD* device node can craft an indirect compute dispatch whose indirect buffer contains zeroed workgroup counts. The condition is reachable through standard Mesa/V3D user-space interfaces without elevated privileges. The vulnerability requires local access to the affected GPU device.
No verified exploitation code is available. See the upstream commits for the technical fix in the Kernel Git Commit Log.
Detection Methods for CVE-2026-53139
Indicators of Compromise
- Unexpected GPU hangs, resets, or v3d driver error messages in dmesg on Raspberry Pi or other V3D-based hardware
- Anomalous compute shader workloads originating from unprivileged users on systems running affected kernels
- Kernel log entries referencing v3d_csd job submission failures or timeouts
Detection Strategies
- Inventory Linux systems running the v3d DRM driver and identify kernel versions prior to the fix commits 11e6432836394e00d39e468cd514f9ddb66f1e49, 7f93fad5ea0affc9e1505dd0f7596c0fdb496213, and 9655b56b6de918e1c22b92f3880ae41b052cbd00
- Monitor kernel logs for repeated GPU resets or job timeouts associated with CSD submissions
- Audit which local users and containers have access to /dev/dri/render* device nodes on affected hardware
Monitoring Recommendations
- Enable kernel audit logging for DRM ioctl calls on systems exposing the v3d device to untrusted workloads
- Track kernel package versions across embedded Linux fleets using configuration management tools
- Alert on v3d driver warnings, GPU resets, and abnormal compute job completion times in centralized logging
How to Mitigate CVE-2026-53139
Immediate Actions Required
- Update affected Linux kernels to a version containing the upstream fix commits referenced in the Kernel Git Commit Log
- Restrict access to /dev/dri/render* device nodes to trusted users and processes on systems running the v3d driver
- Review container and sandbox configurations to ensure GPU device passthrough is limited to required workloads
Patch Information
The vulnerability is resolved upstream in the Linux kernel through three commits in the stable tree: commit 11e6432836, commit 7f93fad5ea, and commit 9655b56b6d. The patches modify the v3d driver to overwrite indirect CSD job workgroup counts with the indirect BO values and skip hardware submission when any workgroup dimension is zero.
Workarounds
- Unload the v3d kernel module on systems that do not require GPU compute functionality using modprobe -r v3d
- Apply user namespace and cgroup device restrictions to prevent unprivileged access to the DRM render node
- Avoid running untrusted GPU compute workloads on affected hardware until the kernel is patched
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
