Improper Initialization in Linux kernel - CVE-2026-53374
Published: July 21, 2026
Vulnerability identifier: #VU138889
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-53374
CWE-ID: CWE-665
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a local user to cause memory corruption in GPU address translation.
The vulnerability exists due to improper initialization in the AMDGPU GART table when allocating and populating page table entries in VRAM. A local user can trigger GART mappings so that stale uninitialized entries are used to cause memory corruption in GPU address translation.
The issue arises because speculative TLB loads may consume other uninitialized entries from the same cacheline, and stale garbage page table entries may later be used by the GPU.
How to mitigate CVE-2026-53374
Install security update from vendor's repository.
Sources
- https://git.kernel.org/stable/c/40df11255d71b02e20e70579f1b12b687e396e26
- https://git.kernel.org/stable/c/791941be5da125d9a1b228582bfdc300c05d05b3
- https://git.kernel.org/stable/c/8ae8b9e74bab94aab1d79f1688129bcc61c8b29a
- https://git.kernel.org/stable/c/91fbb5e635c8fb1b49e15c19da06480089ef719f
- https://git.kernel.org/stable/c/b17175d0a375b3ed5e81597dac4983fdb46e478d
- https://git.kernel.org/stable/c/e6c2e6c2e1fa066968a16aca1cb66cd1bdde7741