The Linux kernel's drm/v3d driver contained a vulnerability where the function v3d_rewrite_csd_job_wg_counts_from_indirect() mapped both an indirect buffer and a workgroup buffer but did not always release these mappings if any workgroup count read from the buffer was zero. Instead of properly cleaning up, the function returned early, causing a leak of the virtual address mappings of both buffer objects (BOs). The fix involves restructuring the code to always jump to the cleanup path before returning, preventing the leak.

The vulnerability results in a resource leak of virtual address mappings in kernel memory, classified as a memory leak (CWE-401). The CVSS vector indicates local attack vector with low complexity and low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but a high impact on availability. This means the vulnerability could lead to denial of service conditions due to resource exhaustion but does not allow data compromise or privilege escalation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or vendor advisories are provided, users should monitor official Linux kernel updates for a fix addressing CVE-2026-53140. Until then, limiting local access to trusted users may reduce risk.