Executive brief
The Linux kernel's GPU driver (drm/msm) contains a memory reference leak in its GPU hang recovery handler. Every time a GPU hang is detected and recovery is initiated, a process reference is not properly released, gradually consuming kernel memory. While not immediately exploitable for privilege escalation, repeated GPU hangs could lead to denial of service through memory exhaustion.
Technical details
The vulnerability is a reference leak in the recover_worker() function of drivers/gpu/drm/msm/msm_gpu.c. The code calls get_pid_task() to obtain a task_struct pointer (which increments its reference count), but the corresponding put_task_struct() call was missing in an else branch. This causes the reference count to never be decremented on that code path. The leak occurs during GPU hang recovery, affecting systems with Qualcomm Adreno GPUs. The impact is denial of service through memory exhaustion; no special privileges or network access are required—only the ability to trigger GPU hangs through graphics workloads.
Affected products
- Linux Linux kernel 4.19 through 6.9 (and earlier versions with drm/msm GPU driver)
Timeline
- 2026-09-17: disclosed
- 2026-06-05: patched: Upstream fix committed