CVE-2026-53141 Overview
CVE-2026-53141 is a reference counting flaw in the Linux kernel's Broadcom VideoCore V3D Direct Rendering Manager (drm/v3d) driver. The defect resides in the global performance monitor (perfmon) management logic. The v3d_perfmon_find() function increments a reference count on the returned perfmon, but v3d_perfmon_set_global_ioctl() and v3d_perfmon_delete() fail to release that reference along multiple code paths. Repeatedly invoking the affected ioctls leaks kernel object references and the associated memory.
Critical Impact
Local users with access to the V3D DRM device can leak kernel perfmon references through SET_GLOBAL and CLEAR_GLOBAL ioctls, leading to memory exhaustion and potential denial of service on affected systems.
Affected Products
- Linux kernel versions containing the drm/v3d global performance monitor ioctl implementation
- Systems using Broadcom VideoCore V3D GPU hardware (Raspberry Pi and similar platforms)
- Distributions shipping unpatched Linux kernels prior to the referenced stable commits
Discovery Timeline
- 2026-06-25 - CVE-2026-53141 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-53141
Vulnerability Analysis
The vulnerability is a memory leak rooted in incorrect reference counting [CWE-401] within the drm/v3d kernel driver. The v3d_perfmon_find() helper returns a perfmon object with its reference count incremented. Callers are responsible for releasing the reference once they are finished with the object.
The SET_GLOBAL ioctl handler v3d_perfmon_set_global_ioctl() and the destroy handler v3d_perfmon_delete() violate this contract on multiple paths. Each invocation that hits an unbalanced path leaves a stale reference on the perfmon, preventing its release.
Root Cause
Three distinct leak paths exist in the affected code. First, v3d_perfmon_set_global_ioctl() leaks the lookup reference on its error paths. Second, the CLEAR_GLOBAL operation leaks both the freshly acquired v3d_perfmon_find() reference and the reference previously stashed in v3d->global_perfmon by an earlier SET_GLOBAL ioctl. Third, destroying a perfmon that is currently configured as the global perfmon leaks the reference held by v3d->global_perfmon.
Attack Vector
Exploitation requires local access to the V3D DRM device node, typically /dev/dri/cardN. An attacker with permission to issue ioctls on this device can repeatedly invoke the affected SET_GLOBAL, CLEAR_GLOBAL, and perfmon destroy operations. Each iteration leaks kernel object references, gradually exhausting kernel memory and degrading system availability.
The fix is documented in the stable kernel commits 3e19475, 6bf7e2a, and ed2eaf3, which explicitly release each leaked reference.
Detection Methods for CVE-2026-53141
Indicators of Compromise
- Steady growth in kernel slab allocations attributable to v3d perfmon objects without corresponding releases
- Unprivileged or low-privilege processes issuing repeated DRM_IOCTL_V3D_PERFMON_SET_GLOBAL and DRM_IOCTL_V3D_PERFMON_DESTROY calls
- Gradual decline in available kernel memory on systems exposing /dev/dri/cardN to non-root users
Detection Strategies
- Audit kernel version strings across the fleet and flag hosts running V3D-capable kernels lacking the referenced stable commits
- Monitor slabinfo for unbounded growth in DRM-related allocations on Broadcom VideoCore platforms
- Instrument or trace ioctl activity on /dev/dri/card* nodes using eBPF or auditd rules targeting DRM perfmon opcodes
Monitoring Recommendations
- Track per-process ioctl rates against DRM devices and alert on sustained anomalous bursts
- Baseline kernel memory usage on V3D platforms and trigger on unusual upward drift
- Forward kernel memory pressure events and OOM notifications to a centralized telemetry pipeline for correlation
How to Mitigate CVE-2026-53141
Immediate Actions Required
- Inventory all systems running Broadcom VideoCore V3D hardware, including Raspberry Pi devices, and identify kernel versions in use
- Apply the upstream stable patches referenced in commits 3e1947573140, 6bf7e2affc6e, and ed2eaf3b7b18 or upgrade to a distribution kernel that includes them
- Restrict access to /dev/dri/card* device nodes to trusted users where the V3D driver is loaded but not required for general user workloads
Patch Information
The Linux kernel maintainers resolved the issue by explicitly releasing the leaked perfmon references in v3d_perfmon_set_global_ioctl() error paths, in the CLEAR_GLOBAL operation, and in v3d_perfmon_delete() when the destroyed perfmon is the active global perfmon. The fixes are available in the stable kernel commits 3e19475, 6bf7e2a, and ed2eaf3.
Workarounds
- Unload or blacklist the v3d kernel module on systems that do not require GPU acceleration
- Tighten permissions on /dev/dri/card* nodes through udev rules and group membership controls
- Apply cgroup memory limits to processes interacting with the V3D DRM device to bound the impact of leak-driven exhaustion
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
