CVE-2026-53201

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-53201", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-06-09T07:44:35.391Z", "datePublished": "2026-06-25T08:39:09.631Z", "dateUpdated": "2026-08-05T12:34:05.024Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:34:05.024Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"drm/xe: Skip exec queue schedule toggle if queue is idle during suspend\"\n\nThis reverts commit 8533051ce92015e9cc6f75e0d52119b9d91610b6.\n\nThe idle-skip optimization bypasses GuC suspend, so the GPU may not\nperform the context switch that flushes TLB entries for invalidated\nuserptr VMAs. In LR/preempt-fence VM mode, this can lead to missed TLB\ninvalidation and page faults during userptr invalidation tests.\n\nRestore unconditional schedule toggling on suspend so the context-switch\nTLB flush is always performed.\n\nThis optimization will be reintroduced with a fix that does not skip\nsuspend in LR/preempt-fence VM mode.\n\n(cherry picked from commit 6a1e7934d9a6cf46aecae00a99c2603d1295e170)"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Reachability is through local DRM Xe render-node IOCTLs such as VM creation, userptr VM_BIND, exec-queue creation, and EXEC submission. The affected path is not exposed over the network or an adjacent/physical protocol.\nAC:L - The attacker can create the required LR/preempt-fence fault-mode VM, non-parallel idle exec queue, userptr mapping, and invalidation sequence themselves. The idle/suspend condition is attacker-controllable and does not require winning an external race.\nPR:L - The IOCTLs are DRM_RENDER_ALLOW and do not require CAP_SYS_ADMIN or another real root capability. Exploitation requires only a local user able to open the Xe DRM render device.\nUI:N - No victim action is required after the attacker has local access to the render node. The attacker can drive queue creation, submission, and userptr invalidation directly.\nS:U - The vulnerability affects the same host kernel/GPU memory-management security authority. There is no demonstrated VM escape, IOMMU bypass across guests, or separate security authority transition.\nC:H - Missed TLB invalidation can leave stale GPU translations to invalidated userptr pages, allowing GPU commands to read physical pages after they are reused. In the highest reasonable scenario this can disclose arbitrary sensitive memory.\nI:H - GPU writes through stale translations can corrupt pages after reuse by another process or the kernel. This is a stale DMA-style memory corruption primitive with high integrity impact.\nA:H - The stale translations can trigger GPU page faults, hangs, resets, or broader memory corruption. Repeated triggering can cause high availability impact to the GPU subsystem and potentially the kernel."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/xe/xe_exec_queue.h", "drivers/gpu/drm/xe/xe_guc_submit.c", "drivers/gpu/drm/xe/xe_hw_engine_group.c"], "versions": [{"version": "8533051ce92015e9cc6f75e0d52119b9d91610b6", "lessThan": "b69b715f48ac7e802c89ed5924795c5b055da91e", "status": "affected", "versionType": "git"}, {"version": "8533051ce92015e9cc6f75e0d52119b9d91610b6", "lessThan": "fa7c84726dc217ce0c183926ef9411636c7a2213", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/xe/xe_exec_queue.h", "drivers/gpu/drm/xe/xe_guc_submit.c", "drivers/gpu/drm/xe/xe_hw_engine_group.c"], "versions": [{"version": "7.0", "status": "affected"}, {"version": "0", "lessThan": "7.0", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.13", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndExcluding": "7.0.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b69b715f48ac7e802c89ed5924795c5b055da91e"}, {"url": "https://git.kernel.org/stable/c/fa7c84726dc217ce0c183926ef9411636c7a2213"}], "title": "Revert \"drm/xe: Skip exec queue schedule toggle if queue is idle during suspend\"", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/xe/xe_exec_queue.h", "drivers/gpu/drm/xe/xe_guc_submit.c", "drivers/gpu/drm/xe/xe_hw_engine_group.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b69b715f48ac7e802c89ed5924795c5b055da91e", "status": "affected", "version": "8533051ce92015e9cc6f75e0d52119b9d91610b6", "versionType": "git"}, {"lessThan": "fa7c84726dc217ce0c183926ef9411636c7a2213", "status": "affected", "version": "8533051ce92015e9cc6f75e0d52119b9d91610b6", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/xe/xe_exec_queue.h", "drivers/gpu/drm/xe/xe_guc_submit.c", "drivers/gpu/drm/xe/xe_hw_engine_group.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.0"}, {"lessThan": "7.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A6A85CDC-815A-4808-8C81-4703E7947CC5", "versionEndExcluding": "7.0.13", "versionStartIncluding": "7.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*", "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*", "matchCriteriaId": "81DFF19E-9CF8-49C6-8C36-1E4038622933", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:*", "matchCriteriaId": "B0E8FC71-3952-444C-83E9-718DBBBEC615", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"drm/xe: Skip exec queue schedule toggle if queue is idle during suspend\"\n\nThis reverts commit 8533051ce92015e9cc6f75e0d52119b9d91610b6.\n\nThe idle-skip optimization bypasses GuC suspend, so the GPU may not\nperform the context switch that flushes TLB entries for invalidated\nuserptr VMAs. In LR/preempt-fence VM mode, this can lead to missed TLB\ninvalidation and page faults during userptr invalidation tests.\n\nRestore unconditional schedule toggling on suspend so the context-switch\nTLB flush is always performed.\n\nThis optimization will be reintroduced with a fix that does not skip\nsuspend in LR/preempt-fence VM mode.\n\n(cherry picked from commit 6a1e7934d9a6cf46aecae00a99c2603d1295e170)"}], "id": "CVE-2026-53201", "lastModified": "2026-07-06T12:32:17.800", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-06-25T09:16:37.690", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b69b715f48ac7e802c89ed5924795c5b055da91e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fa7c84726dc217ce0c183926ef9411636c7a2213"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: Revert \"drm/xe: Skip exec queue schedule toggle if queue is idle during suspend\"", "id": "2492830", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492830"}, "csaw": false, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nRevert \"drm/xe: Skip exec queue schedule toggle if queue is idle during suspend\"\nThis reverts commit 8533051ce92015e9cc6f75e0d52119b9d91610b6.\nThe idle-skip optimization bypasses GuC suspend, so the GPU may not\nperform the context switch that flushes TLB entries for invalidated\nuserptr VMAs. In LR/preempt-fence VM mode, this can lead to missed TLB\ninvalidation and page faults during userptr invalidation tests.\nRestore unconditional schedule toggling on suspend so the context-switch\nTLB flush is always performed.\nThis optimization will be reintroduced with a fix that does not skip\nsuspend in LR/preempt-fence VM mode.\n(cherry picked from commit 6a1e7934d9a6cf46aecae00a99c2603d1295e170)"], "name": "CVE-2026-53201", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-06-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-53201\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-53201\nhttps://lore.kernel.org/linux-cve-announce/2026062500-CVE-2026-53201-039c@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8533051ce92015e9cc6f75e0d52119b9d91610b6,b69b715f48ac7e802c89ed5924795c5b055da91e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8533051ce92015e9cc6f75e0d52119b9d91610b6,fa7c84726dc217ce0c183926ef9411636c7a2213)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.13,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-06-25T13:30:15.850765+00:00", "updated": "2026-08-12T08:30:16.965557+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-665", "CWE-779", "NVD-CWE-noinfo"]}