CVE-2026-46211
Memory Corruption in Linux Kernel DRM MSM GEM
Publication date: 2026-05-28
Last updated on: 2026-05-28
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's drm/msm/gem component, specifically in the function msm_ioctl_gem_info_get_metadata(). The function always returns 0 regardless of errors, meaning it signals success even when operations like copy_to_user() fail or the user buffer is too small.
Additionally, the function uses kmemdup() to allocate memory but does not check if the allocation failed (i.e., if kmemdup() returns NULL). This can lead to a NULL pointer dereference when copy_to_user() is called afterward.
The vulnerability causes userspace programs to incorrectly believe that the ioctl call succeeded when it actually failed, potentially leading to incorrect behavior or data handling.
How can this vulnerability impact me? :
Because the function msm_ioctl_gem_info_get_metadata() always returns success even when errors occur, userspace applications may proceed under false assumptions that data operations succeeded.
This can lead to incorrect application behavior, data corruption, or crashes due to the NULL pointer dereference caused by unchecked memory allocation failure.
Overall, the vulnerability undermines the reliability and stability of applications interacting with this kernel component.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the Linux kernel to a version that includes the patch fixing the error handling in msm_ioctl_gem_info_get_metadata(). This patch adds the missing NULL check for kmemdup() and ensures the function returns the correct error code instead of always returning 0.
Until the update is applied, avoid using the affected ioctl (msm_ioctl_gem_info_get_metadata) in userspace applications to prevent potential issues caused by incorrect error reporting or NULL pointer dereferences.