What is CVE-2026-53190?

CVE-2026-53190 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10, affecting Linux kernel versions from 6.5 onward and patched in 6.6.143, 6.12.94, 6.18.36 and others. CVE-2026-53190 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2026-53190?

CVE-2026-53190 has a CVSS score of 5.5 out of 10, rated Medium severity. The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Is there a patch available for CVE-2026-53190?

Yes, CVE-2026-53190 has been patched. Fixed versions include 6.6.143, 6.12.94, 6.18.36 and others. If you are running Linux kernel 6.5 or later up to the fix versions, apply the relevant patch for your kernel branch.

Is CVE-2026-53190 actively exploited?

CVE-2026-53190 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

CVE-2026-53190

Medium

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() dma_fence_unwrap_for_each() internally calls dma_fence_unwrap_first() which does cursor->chain = dma_fence_get(head), taking an extra reference. On normal loop completion, dma_fence_unwrap_next() releases this via dma_fence_chain_walk() -> dma_fence_put(). When virtio_gpu_do_fence_wait() fails and the function returns early from inside the loop, the cursor->chain reference is never released. This is the only caller in the entire kernel that does an early return inside dma_fence_unwrap_for_each. Add dma_fence_put(itr.chain) before the early return.

Package Linux Kernel

Published 2026-06-25

Last modified 2026-07-06

CVSS version 3.1

Patch available

Yes

CVSS 3.1 score

5.5

out of 10

Medium

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected versions

Linux kernel versions 6.5 and later are affected. Fixed in 6.6.143, 6.12.94, 6.18.36, 7.0.13, 7.1 and their respective stable series.

Affected from

≥ 6.5

Fixed in

✓ 6.6.143 6.6.x ✓ 6.12.94 6.12.x ✓ 6.18.36 6.18.x ✓ 7.0.13 7.0.x ✓ 7.1

References

5 total

Kernel Git
https://git.kernel.org/stable/c/3f26bb732cc136ab20176697c92f32c9c84cb125

Patch
Kernel Git
https://git.kernel.org/stable/c/73524e9f96a278b521f257a78a845c49eb522bc1

Patch
Kernel Git
https://git.kernel.org/stable/c/8348567a6afb24e2c9cafe8a321162d0eebe1411

Patch
Kernel Git
https://git.kernel.org/stable/c/898bd0ccfed71651b881660c5d20ad73b5203174

Patch
Kernel Git
https://git.kernel.org/stable/c/c0fffc874c264292e769f26194a2a5e66ce31810

Patch

Details

CVE ID CVE-2026-53190

Severity Medium

CVSS score 5.5 / 10

CVSS version 3.1

Published 2026-06-25

Modified 2026-07-06

KEV No

Patch

Yes

Package linux

Frequently asked questions

What is CVE-2026-53190?

CVE-2026-53190 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10 . It affects Linux kernel versions from 6.5 onward and has been patched in 6.6.143, 6.12.94, 6.18.36 and others. CVE-2026-53190 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2026-53190?

CVE-2026-53190 has a CVSS score of 5.5 out of 10, rated Medium severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
Is there a patch available for CVE-2026-53190?

Yes. CVE-2026-53190 has been patched. Fixed versions include 6.6.143, 6.12.94, 6.18.36 and others. If you are running Linux kernel 6.5 or later up to the fix versions, apply the relevant patch for your kernel branch.
Is CVE-2026-53190 actively exploited?

No. CVE-2026-53190 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.