In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Skip CSD when it has zeroed workgroups A compute shader dispatch… (CVE-2026-53139)
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Skip CSD when it has zeroed workgroups A compute shader dispatch encodes its workgroup counts in the CFG0..CFG2 registers. Kicking off a dispatch with a zero count in any of the three dimensions is invalid. First, the hardware will process 0 as 65536, while the user-space driver exposes a maximum of 65535. Over that, a submission with a zeroed workgroup dimension should be a no-op. These zeroed counts can reach the dispatch path through an indirect CSD job, whose workgroup counts are only known once the indirect buffer is read and may legitimately be zero, but such scenario should only result in a no-op. Overwrite the indirect CSD job workgroup counts with the indirect BO ones, even if they are zeroed, and don't submit the job to the hardware when any of the workgroup counts is zero, so the job completes immediately instead of running the shader.
AI Analysis
Technical Summary
The Linux kernel vulnerability CVE-2026-53139 affects the drm/v3d driver where compute shader dispatches with zeroed workgroup counts are improperly handled. Hardware interprets zero counts as 65536, exceeding the user-space maximum of 65535, causing invalid dispatches. Zeroed counts can propagate through indirect CSD jobs, which should result in no operation. The resolution involves overwriting indirect CSD job workgroup counts with those from the indirect buffer and skipping submission to hardware if any dimension is zero, causing immediate job completion instead of shader execution.
Potential Impact
This vulnerability could cause invalid compute shader dispatches that may lead to unexpected hardware behavior or resource misuse. However, the description does not specify direct exploitation consequences such as privilege escalation or denial of service. The impact is limited to incorrect handling of zeroed workgroup counts in compute shader dispatches.
Mitigation Recommendations
No explicit patch or vendor advisory is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves skipping dispatch submission when zeroed workgroup counts are detected, which should be implemented in the Linux kernel drm/v3d driver.
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Skip CSD when it has zeroed workgroups A compute shader dispatch… (CVE-2026-53139)
Description
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Skip CSD when it has zeroed workgroups A compute shader dispatch encodes its workgroup counts in the CFG0..CFG2 registers. Kicking off a dispatch with a zero count in any of the three dimensions is invalid. First, the hardware will process 0 as 65536, while the user-space driver exposes a maximum of 65535. Over that, a submission with a zeroed workgroup dimension should be a no-op. These zeroed counts can reach the dispatch path through an indirect CSD job, whose workgroup counts are only known once the indirect buffer is read and may legitimately be zero, but such scenario should only result in a no-op. Overwrite the indirect CSD job workgroup counts with the indirect BO ones, even if they are zeroed, and don't submit the job to the hardware when any of the workgroup counts is zero, so the job completes immediately instead of running the shader.
CVSS v3.1
Score 5.5medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel vulnerability CVE-2026-53139 affects the drm/v3d driver where compute shader dispatches with zeroed workgroup counts are improperly handled. Hardware interprets zero counts as 65536, exceeding the user-space maximum of 65535, causing invalid dispatches. Zeroed counts can propagate through indirect CSD jobs, which should result in no operation. The resolution involves overwriting indirect CSD job workgroup counts with those from the indirect buffer and skipping submission to hardware if any dimension is zero, causing immediate job completion instead of shader execution.
Potential Impact
This vulnerability could cause invalid compute shader dispatches that may lead to unexpected hardware behavior or resource misuse. However, the description does not specify direct exploitation consequences such as privilege escalation or denial of service. The impact is limited to incorrect handling of zeroed workgroup counts in compute shader dispatches.
Mitigation Recommendations
No explicit patch or vendor advisory is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves skipping dispatch submission when zeroed workgroup counts are detected, which should be implemented in the Linux kernel drm/v3d driver.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-qcxp-rj5j-4rr9
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-53139"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- 3.1
Threat ID: 6a498a7327e9c7971936ea0d
Added to database: 07/04/2026, 22:34:27 UTC
Last enriched: 07/04/2026, 23:07:54 UTC
Last updated: 07/31/2026, 19:24:49 UTC
Views: 52
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.