CVE-2026-93059

What it actually does

Missing put_task_struct call after get_pid_task in the else branch of the recover_worker function causes a task_struct reference count leak on every GPU hang recovery, leading to use-after-free conditions in the Linux kernel MSM DRM driver.

Why it matters to the business

On systems using affected Linux kernels with MSM GPUs, this flaw may enable system crashes, privilege escalation, or denial of service after repeated GPU recovery events, with low immediate risk due to stable low exploit probability and no known active exploitation campaigns.

How an attack unfolds

An attacker repeatedly triggers GPU hangs to force execution of the recover_worker path, accumulating leaked task_struct references until a use-after-free window allows manipulation of freed kernel memory for code execution or privilege escalation.

How to fix it

Apply the upstream kernel patch that adds the missing put_task_struct call in the recover_worker else branch; update to a fixed Linux kernel version containing this change.

How to confirm the fix worked

Inspect the drm/msm recover_worker source to confirm put_task_struct is present in the else branch after get_pid_task, and verify the patch commit from the referenced Patchwork link is applied.

Typical attack path

1. Trigger repeated GPU hangs in the MSM DRM subsystem
2. Force execution of recover_worker else branch without reference release
3. Accumulate task_struct reference leaks leading to use-after-free
4. Exploit freed memory for kernel-level access or denial of service

How to detect it

Review kernel logs and dmesg output for repeated GPU recovery events or task_struct related warnings around drm/msm; correlate with memory leak indicators or unexplained reference count growth in kernel debugging tools.

What your security team should do

• Prioritize kernel updates for systems with MSM GPUs within standard patch cycles given low EPSS and absence from known exploited lists
• Monitor kernel changelog and distribution security advisories for this reference leak fix
• Restrict unprivileged access to GPU devices where feasible to reduce hang recovery exposure