What is CVE-2026-53377?

CVE-2026-53377 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10, affecting Linux kernel versions from 5.19 onward and patched in 6.18.32, 7.0.9 and 7.1. CVE-2026-53377 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2026-53377?

CVE-2026-53377 has a CVSS score of 5.5 out of 10, rated Medium severity. The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Is there a patch available for CVE-2026-53377?

Yes, CVE-2026-53377 has been patched. Fixed versions include 6.18.32, 7.0.9 and 7.1. If you are running Linux kernel 5.19 or later up to the fix versions, apply the relevant patch for your kernel branch.

Is CVE-2026-53377 actively exploited?

CVE-2026-53377 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

CVE-2026-53377

Medium

In the Linux kernel, the following vulnerability has been resolved: drm/msm: always recover the gpu Previously, in case there was no more work to do, recover worker wouldn't trigger recovery and would instead rely on the gpu going to sleep and then resuming when more work is submitted. Recover_worker will first increment the fence of the hung ring so, if there's only one job submitted to a ring and that causes an hang, it will early out. There's no guarantee that the gpu will suspend and resume before more work is submitted and if the gpu is in a hung state it will stay in that state and probably trigger a timeout again. Just stop checking and always recover the gpu. Patchwork: https://patchwork.freedesktop.org/patch/704066/

Package Linux Kernel

Published 2026-07-19

Last modified 2026-07-29

CVSS version 3.1

Patch available

Yes

CVSS 3.1 score

5.5

out of 10

Medium

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected versions

Linux kernel versions 5.19 and later are affected. Fixed in 6.18.32, 7.0.9, 7.1 and their respective stable series.

Affected from

≥ 5.19

Fixed in

✓ 6.18.32 6.18.x ✓ 7.0.9 7.0.x ✓ 7.1

References

3 total

Kernel Git
https://git.kernel.org/stable/c/01a0d6cd7032e9993feea19fadb03ef9d5b488f2

Patch
Kernel Git
https://git.kernel.org/stable/c/132b8d51f0ffbee6e4e1ebbe1a50330aaf2dbd5d

Patch
Kernel Git
https://git.kernel.org/stable/c/2f5c90478749dfd9a32386100b6078a364298b01

Patch

Details

CVE ID CVE-2026-53377

Severity Medium

CVSS score 5.5 / 10

CVSS version 3.1

Published 2026-07-19

Modified 2026-07-29

KEV No

Patch

Yes

Package linux

Frequently asked questions

What is CVE-2026-53377?

CVE-2026-53377 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10 . It affects Linux kernel versions from 5.19 onward and has been patched in 6.18.32, 7.0.9 and 7.1. CVE-2026-53377 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2026-53377?

CVE-2026-53377 has a CVSS score of 5.5 out of 10, rated Medium severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
Is there a patch available for CVE-2026-53377?

Yes. CVE-2026-53377 has been patched. Fixed versions include 6.18.32, 7.0.9 and 7.1. If you are running Linux kernel 5.19 or later up to the fix versions, apply the relevant patch for your kernel branch.
Is CVE-2026-53377 actively exploited?

No. CVE-2026-53377 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.