← Back to CVE Explorer

CVE-2026-100077

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Recover HW before retire hung submit During recovery, it is not safe to retire the hung submit before we recover the GPU. Retiring the submit triggers BO free and that can result in GPU pagefaults since the GPU may be actively accessing those BOs. To fix this, retire the submits after gpu recovery is complete in recover_worker(). Patchwork: https://patchwork.freedesktop.org/patch/730655/

Severity
MEDIUM
CVSS score
5.5 (v3.1)
Vulnerability status
Undergoing Analysis
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-09-25 14:17:14.593000
Last modified
2026-10-30 13:18:27.837000
View original CVE JSON 
{
  "id": "CVE-2026-100077",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-09-25T14:17:14.593",
  "lastModified": "2026-10-30T13:18:27.837",
  "vulnStatus": "Undergoing Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm: Recover HW before retire hung submit\n\nDuring recovery, it is not safe to retire the hung submit before we\nrecover the GPU. Retiring the submit triggers BO free and that can\nresult in GPU pagefaults since the GPU may be actively accessing those\nBOs.\n\nTo fix this, retire the submits after gpu recovery is complete in\nrecover_worker().\n\nPatchwork: https://patchwork.freedesktop.org/patch/730655/"
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "drivers/gpu/drm/msm/msm_gpu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5",
              "lessThan": "9cf623ae29876788adfddd6ca01e2b8545594c14",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5",
              "lessThan": "d4bee74b7cb93e40c60b43dc9dc0c3aab444649f",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5",
              "lessThan": "2f021d93f15829ba052ff22bc40df0ec3ae7c7ab",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5",
              "lessThan": "e36284257eeca13768687bf8e52f66f8ea0e8794",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5",
              "lessThan": "dc64cf9d71428234389b635d142cb5fe07d57eab",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "1a370be9ac51129e40b0ed7fa71d2b2b92bc47e5",
              "lessThan": "b303e1d52811de7d1bcf793560754d4df68d4a1c",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "drivers/gpu/drm/msm/msm_gpu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "4.2",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "4.2",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.1.191",
              "lessThanOrEqual": "6.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.160",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.114",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18.52",
              "lessThanOrEqual": "6.18.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.2.6",
              "lessThanOrEqual": "7.2.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.3",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.2",
              "versionEndExcluding": "6.18.52",
              "matchCriteriaId": "91744612-1EE4-45B1-B38B-CA048AA96F27"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.19",
              "versionEndExcluding": "7.2.6",
              "matchCriteriaId": "BAFE7055-A65A-44F4-BD4B-BF067EAE17F3"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/2f021d93f15829ba052ff22bc40df0ec3ae7c7ab",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9cf623ae29876788adfddd6ca01e2b8545594c14",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b303e1d52811de7d1bcf793560754d4df68d4a1c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/d4bee74b7cb93e40c60b43dc9dc0c3aab444649f",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/dc64cf9d71428234389b635d142cb5fe07d57eab",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/e36284257eeca13768687bf8e52f66f8ea0e8794",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    }
  ]
}