CVE-2026-100077 in Linux
Summary
by MITRE • 09/25/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/msm: Recover HW before retire hung submit
During recovery, it is not safe to retire the hung submit before we recover the GPU. Retiring the submit triggers BO free and that can result in GPU pagefaults since the GPU may be actively accessing those BOs.
To fix this, retire the submits after gpu recovery is complete in recover_worker().
Patchwork: https://patchwork.freedesktop.org/patch/730655/
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
The Linux kernel's Direct Rendering Manager subsystem for Qualcomm MSM GPUs contains a critical race condition within its error recovery mechanism that can lead to system instability and potential denial of service. This vulnerability arises from an incorrect ordering of operations during the GPU hardware recovery process, specifically in the recover_worker function which handles hung command submissions. When the GPU encounters a hang or fatal error, the kernel attempts to reset the hardware state to restore normal operation. However, prior to this fix, the implementation would retire the submitted commands before completing the full restoration of the GPU's internal state and memory management structures. This premature retirement triggers the release of buffer objects associated with those submissions, effectively freeing the underlying physical memory pages while the GPU may still be actively attempting to access them due to pending DMA operations or incomplete hardware resets.
The technical flaw lies in the sequence of cleanup actions during error recovery. Retiring a submit object signals that the command stream has completed and allows the kernel to reclaim resources such as buffer objects, locks, and memory mappings. In this specific scenario, freeing these buffer objects while the GPU is still potentially accessing them causes hardware page faults or bus errors because the physical addresses referenced by the GPU are no longer valid in system RAM. This race condition exploits the asynchronous nature of GPU command processing where software retirement does not immediately halt all hardware activity related to those buffers. The result can be a kernel panic, a complete system freeze, or data corruption if the freed memory is reallocated and written to while still being accessed by the GPU via DMA.
From an operational perspective, this vulnerability impacts the reliability of systems relying on Linux for graphics processing tasks involving MSM GPUs, which are common in mobile devices and embedded platforms running Android or other Linux-based operating systems. An attacker with local access could potentially trigger a GPU hang through crafted 3D commands or compute shaders that exhaust resources or cause timing errors, thereby forcing the recovery path to execute. By inducing this state repeatedly, an adversary could achieve a denial of service against the system without needing elevated privileges beyond those required for graphics rendering. This represents a significant stability issue for production environments where continuous uptime is critical and unexpected reboots are unacceptable.
The remediation involves restructuring the recover_worker function to ensure that GPU hardware recovery is fully completed before any command submissions are retired. By delaying the retirement of hung submits until after the GPU state has been restored, the kernel ensures that buffer objects remain valid during the entire recovery window, preventing invalid memory accesses and subsequent page faults. This change aligns with best practices for resource lifecycle management in concurrent systems where hardware and software states must be synchronized before cleanup operations proceed.
This vulnerability is categorized under CWE-362, which describes a race condition involving shared resources without proper synchronization or locking mechanisms to prevent simultaneous access that leads to unexpected behavior. In the context of the MITRE ATT&CK framework for Linux systems, this issue relates to techniques involving resource exhaustion and denial of service through exploitation of kernel-level logic errors rather than buffer overflows or privilege escalation vectors. The fix emphasizes the importance of strict ordering in error handling routines where hardware state transitions must precede software-side resource reclamation to maintain system integrity during fault recovery scenarios.