CVE-2026-46211
Analyzed Analyzed - Analysis Complete
Memory Corruption in Linux Kernel DRM MSM GEM

Publication date: 2026-05-28

Last updated on: 2026-06-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata() msm_ioctl_gem_info_get_metadata() always returns 0 regardless of errors. When copy_to_user() fails or the user buffer is too small, the error code stored in ret is ignored because the function unconditionally returns 0. This causes userspace to believe the ioctl succeeded when it did not. Additionally, kmemdup() can return NULL on allocation failure, but the return value is not checked. This leads to a NULL pointer dereference in the subsequent copy_to_user() call. Add the missing NULL check for kmemdup() and return ret instead of 0. Note that the SET counterpart (msm_ioctl_gem_info_set_metadata) correctly returns ret. Patchwork: https://patchwork.freedesktop.org/patch/714478/
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-28
Last Modified
2026-06-10
Generated
2026-06-17
AI Q&A
2026-05-28
EPSS Evaluated
2026-06-16
NVD
CVE-2026-46211
EUVD
EUVD-2026-32838
Affected Vendors & Products
Showing 3 associated CPEs
Vendor Product Version / Range
linux linux_kernel From 6.13 (inc) to 6.18.32 (exc)
linux linux_kernel From 6.19 (inc) to 7.0.9 (exc)
linux linux_kernel From 6.8 (inc) to 6.12.90 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Linux kernel's drm/msm/gem component, specifically in the function msm_ioctl_gem_info_get_metadata(). The function always returns 0 regardless of errors, meaning it signals success even when operations like copy_to_user() fail or the user buffer is too small.

Additionally, the function uses kmemdup() to allocate memory but does not check if the allocation failed (i.e., if kmemdup() returns NULL). This can lead to a NULL pointer dereference when copy_to_user() is called afterward.

The vulnerability causes userspace programs to incorrectly believe that the ioctl call succeeded when it actually failed, potentially leading to incorrect behavior or data handling.

Impact Analysis

Because the function msm_ioctl_gem_info_get_metadata() always returns success even when errors occur, userspace applications may proceed under false assumptions that data operations succeeded.

This can lead to incorrect application behavior, data corruption, or crashes due to the NULL pointer dereference caused by unchecked memory allocation failure.

Overall, the vulnerability undermines the reliability and stability of applications interacting with this kernel component.

Mitigation Strategies

To mitigate this vulnerability, update the Linux kernel to a version that includes the patch fixing the error handling in msm_ioctl_gem_info_get_metadata(). This patch adds the missing NULL check for kmemdup() and ensures the function returns the correct error code instead of always returning 0.

Until the update is applied, avoid using the affected ioctl (msm_ioctl_gem_info_get_metadata) in userspace applications to prevent potential issues caused by incorrect error reporting or NULL pointer dereferences.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-46211. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart