CVE-2026-53377: Linux Kernel Privilege Escalation Flaw

CVE-2026-53377 Overview

CVE-2026-53377 affects the Linux kernel's Direct Rendering Manager (DRM) driver for Qualcomm MSM GPUs (drm/msm). The flaw resides in the GPU recover worker logic, which previously skipped recovery when no additional work remained queued. The recover worker relied on the GPU suspending and later resuming to clear a hung state, an assumption that does not hold if additional jobs are submitted before suspend occurs. As a result, a hung GPU could remain in that state and re-trigger timeouts. Upstream maintainers resolved the issue by unconditionally recovering the GPU regardless of pending workload.

Critical Impact
A hung MSM GPU can remain unrecovered, producing repeated timeouts and degraded graphics/compute availability on affected Linux systems until the kernel is patched.

Affected Products

Linux kernel drm/msm driver (Qualcomm Adreno GPU support)
Linux distributions shipping the affected kernel versions prior to the upstream fix
Devices with Qualcomm MSM/Snapdragon GPUs using the mainline drm/msm driver

Discovery Timeline

2026-07-19 - CVE-2026-53377 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-53377

Vulnerability Analysis

The defect is a logic flaw in the GPU recovery worker of the drm/msm kernel driver. When a GPU job hangs, the recover worker increments the fence of the hung ring. If only a single job was queued on the ring, the worker early-exits without performing the actual recovery routine, deferring the reset to the suspend/resume path.

This approach assumes the GPU will enter suspend before any new submission arrives. On active systems that assumption fails. If additional work is submitted while the GPU is still hung, the driver skips the required reset and continues to operate against a non-functional GPU state. The subsequent submission triggers another timeout, producing repeated hang cycles.

Because the flaw is a missed recovery path rather than a memory-safety issue, no CWE identifier and no CVSS score have been assigned. The EPSS probability is 0.155%.

Root Cause

The root cause is a conditional check in the recover worker that short-circuits recovery when no further jobs are pending. The check treats the empty queue as evidence that suspend will clear the hang, ignoring the race with new submissions and the possibility that the GPU is already wedged.

Attack Vector

The issue is primarily a reliability and denial-of-service condition triggered by workloads that induce a GPU hang. No remote or authenticated exploitation vector has been documented. Local processes submitting GPU work that triggers a hang can indirectly cause repeated timeouts and loss of GPU availability.

No verified proof-of-concept code has been published. Technical details are available in the upstream commits referenced by the NVD entry and the Freedesktop Patchwork submission.

Detection Methods for CVE-2026-53377

Indicators of Compromise

Repeated msm GPU timeout messages in dmesg or the systemd journal indicating hangs on the same ring
Kernel log entries referencing the recover worker without a corresponding successful GPU reset
User-visible graphics stalls, compositor freezes, or GPU compute job failures on Qualcomm MSM hardware

Detection Strategies

Audit running kernel versions across Linux fleets and cross-reference against the fixed commits 01a0d6cd7032, 132b8d51f0ff, and 2f5c90478749
Monitor kernel ring buffers for drm/msm timeout and hang messages that recur without a recovery-success log line
Correlate GPU-related crashes reported by userspace graphics stacks with kernel timeout events to identify unrecovered hangs

Monitoring Recommendations

Forward dmesg and journald logs from Linux endpoints and edge devices to a central log platform for pattern analysis
Alert on repeated GPU timeout events from the same device within a short window
Track kernel package versions through configuration management to confirm patched builds are deployed

How to Mitigate CVE-2026-53377

Immediate Actions Required

Update the Linux kernel to a version that includes the upstream fix referenced by the three stable-tree commits listed in the NVD entry
Reboot affected devices after patching to ensure the corrected drm/msm module is loaded
Inventory Qualcomm MSM/Adreno-based Linux devices and prioritize those running workloads that stress the GPU

Patch Information

The fix removes the conditional early-out in the recover worker so that the GPU is always reset when a hang is detected. Refer to the upstream commits: 01a0d6cd7032, 132b8d51f0ff, and 2f5c90478749. Consume the patch through your distribution's kernel update channel once the backport is available.

Workarounds

Restart affected systems when GPU hang loops are observed to force a clean GPU state until the patched kernel is deployed
Reduce or reschedule GPU workloads known to trigger the hang on unpatched systems
Where feasible, unload and reload the msm kernel module to reinitialize the GPU state without a full reboot

bash

# Verify running kernel version and check for the fixed commit in the changelog
uname -r
rpm -q --changelog kernel | grep -E "drm/msm|01a0d6cd7032|132b8d51f0ff|2f5c90478749"
# On Debian/Ubuntu
dpkg -l | grep linux-image
apt-get update && apt-get install --only-upgrade linux-image-$(uname -r | sed 's/.*-//')