Skip to main content

Linux Kernel CVE-2026-53056

| EUVDEUVD-2026-38924 MEDIUM
2026-06-24 Linux GHSA-6p48-fhqh-r738
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local-only driver bug requiring low-privilege access; impacts availability via crash only, no confidentiality or integrity effect.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 21, 2026 - 17:38 vuln.today
CVSS changed
Jul 21, 2026 - 17:37 NVD
5.5 (MEDIUM)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:30 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 24, 2026 - 16:30 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

drm/msm/dpu: fix mismatch between power and frequency

During DPU runtime suspend, calling dev_pm_opp_set_rate(dev, 0) drops the MMCX rail to MIN_SVS while the core clock frequency remains at its original (highest) rate. When runtime resume re-enables the clock, this may result in a mismatch between the rail voltage and the clock rate.

For example, in the DPU bind path, the sequence could be: cpu0: dev_sync_state -> rpmhpd_sync_state cpu1: dpu_kms_hw_init timeline 0 ------------------------------------------------> t

After rpmhpd_sync_state, the voltage performance is no longer guaranteed to stay at the highest level. During dpu_kms_hw_init, calling dev_pm_opp_set_rate(dev, 0) drops the voltage, causing the MMCX rail to fall to MIN_SVS while the core clock is still at its maximum frequency. When the power is re-enabled, only the clock is enabled, leading to a situation where the MMCX rail is at MIN_SVS but the core clock is at its highest rate. In this state, the rail cannot sustain the clock rate, which may cause instability or system crash.

Remove the call to dev_pm_opp_set_rate(dev, 0) from dpu_runtime_suspend to ensure the correct vote is restored when DPU resumes.

Patchwork: https://patchwork.freedesktop.org/patch/710077/

AnalysisAI

Instability and system crash vulnerability in the Linux kernel's Qualcomm DRM/MSM Display Processing Unit (DPU) driver allows a local low-privileged attacker to trigger a voltage-clock mismatch that causes the MMCX power rail to fall to MIN_SVS while the DPU core clock remains at its maximum frequency. This race condition between power management and clock control during runtime suspend/resume can leave the hardware in an unsustainable electrical state, leading to display subsystem failure or kernel panic. No public exploit identified at time of analysis; EPSS of 0.18% reflects the hardware-specific, local-only nature of this flaw.

Technical ContextAI

The affected component is the drm/msm/dpu kernel driver - the Display Processing Unit subsystem used on Qualcomm Snapdragon (MSM) SoCs. The root cause is an incorrect ordering of power management operations in dpu_runtime_suspend: calling dev_pm_opp_set_rate(dev, 0) during suspend drops the MMCX voltage rail to MIN_SVS, but the associated core clock frequency is not simultaneously lowered. On subsequent resume, only the clock is re-enabled; because the MMCX rail is already at MIN_SVS (its minimum sustainable voltage), the rail cannot supply the power required to sustain the original (maximum) clock rate. This is an Operating Performance Point (OPP) management flaw - the OPP framework expects voltage and frequency to be co-updated, but the suspend path decouples them. While no CWE is formally assigned, this maps conceptually to a resource management/state synchronization error. Affected products per CPE: cpe:2.3:a:linux:linux:* - specifically any kernel revision from commit b0530eb1191307e9038d75e5c83973a396137681 up to the respective stable-branch fix commits on hardware with a Qualcomm MMCX rail.

RemediationAI

The primary fix is to upgrade to a patched Linux kernel stable release: 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10, or 7.1, which contain the corrected dpu_runtime_suspend function. Upstream fix commits are available at https://git.kernel.org/stable/c/1181a7028d37e0b1e720a36125a03f5db97e3d27 (and the sibling commits listed in references). Ubuntu users should apply USN-8566-1, USN-8567-1, or USN-8568-1 via the standard package manager. If patching is not immediately possible on affected embedded or Android-adjacent Qualcomm platforms, a targeted workaround is to disable runtime power management for the DPU device (e.g., via echo on > /sys/bus/platform/devices/<dpu_dev>/power/control), which prevents the suspend path from executing entirely; this trades increased idle power consumption for stability. There is no authentication or network-level mitigation applicable since the flaw is in hardware driver logic on the local system.

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-HPC-Azure Affected
Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Hardened-GCE Affected
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed

Share

CVE-2026-53056 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy