CVE-2026-53056

drm/msm/dpu: fix mismatch between power and frequency

MEDIUM
5.5
CVSS Score
Published: June 24, 2026 at 04:30 PM UTC
Updated: July 21, 2026 at 05:39 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: fix mismatch between power and frequency During DPU runtime suspend, calling dev_pm_opp_set_rate(dev, 0) drops the MMCX rail to MIN_SVS while the core clock frequency remains at its original (highest) rate. When runtime resume re-enables the clock, this may result in a mismatch between the rail voltage and the clock rate. For example, in the DPU bind path, the sequence could be: cpu0: dev_sync_state -> rpmhpd_sync_state cpu1: dpu_kms_hw_init timeline 0 ------------------------------------------------> t After rpmhpd_sync_state, the voltage performance is no longer guaranteed to stay at the highest level. During dpu_kms_hw_init, calling dev_pm_opp_set_rate(dev, 0) drops the voltage, causing the MMCX rail to fall to MIN_SVS while the core clock is still at its maximum frequency. When the power is re-enabled, only the clock is enabled, leading to a situation where the MMCX rail is at MIN_SVS but the core clock is at its highest rate. In this state, the rail cannot sustain the clock rate, which may cause instability or system crash. Remove the call to dev_pm_opp_set_rate(dev, 0) from dpu_runtime_suspend to ensure the correct vote is restored when DPU resumes. Patchwork: https://patchwork.freedesktop.org/patch/710077/

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

5.9 ≤ v < 6.1.1755.9 ≤ v < 6.12.915.9 ≤ v < 6.18.335.9 ≤ v < 6.6.1415.9 ≤ v < 7.0.105.9 ≤ v < 7.16.13 ≤ v < 6.18.336.19 ≤ v < 7.0.106.2 ≤ v < 6.6.1416.7 ≤ v < 6.12.915.9b0530eb1191307e9038d75e5c83973a396137681
Vendor states this is fixed in 0ccf4f27b4652570b5de3de02a89a86435559de9 (fixed)
Vendor states this is fixed in 0f7dd5839cfabaf9c007fb718ec66e907a473c93 (fixed)
Vendor states this is fixed in 1181a7028d37e0b1e720a36125a03f5db97e3d27 (fixed)
Vendor states this is fixed in 9830999c9e065c1813ec5435bfe4eab98ee54a87 (fixed)
Vendor states this is fixed in bc1dccc518cc5ab5140fba06c27e7188e0ed342b (fixed)
Vendor states this is fixed in c5735c7d0eef7a5240f9c1c66e44ba52a1be58d6 (fixed)
Vendor states this is fixed in 5.9 (unaffected)
Vendor states this is fixed in 6.1.175 (unaffected)
Vendor states this is fixed in 6.12.91 (unaffected)
Vendor states this is fixed in 6.18.33 (unaffected)
Vendor states this is fixed in 6.6.141 (unaffected)
Vendor states this is fixed in 7.0.10 (unaffected)
Vendor states this is fixed in 7.1 (unaffected)

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusANALYZED
CWE
NVD-CWE-noinfo

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card