CVE-2026-46211

Analyzed Analyzed - Analysis Complete

Memory Corruption in Linux Kernel DRM MSM GEM

Publication date: 2026-05-28

Last updated on: 2026-06-10

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata() msm_ioctl_gem_info_get_metadata() always returns 0 regardless of errors. When copy_to_user() fails or the user buffer is too small, the error code stored in ret is ignored because the function unconditionally returns 0. This causes userspace to believe the ioctl succeeded when it did not. Additionally, kmemdup() can return NULL on allocation failure, but the return value is not checked. This leads to a NULL pointer dereference in the subsequent copy_to_user() call. Add the missing NULL check for kmemdup() and return ret instead of 0. Note that the SET counterpart (msm_ioctl_gem_info_set_metadata) correctly returns ret. Patchwork: https://patchwork.freedesktop.org/patch/714478/

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-28

Last Modified

2026-06-10

Generated

2026-07-08

AI Q&A

2026-05-28

EPSS Evaluated

2026-07-06

NVD

CVE-2026-46211

EUVD

EUVD-2026-32838

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.13 (inc) to 6.18.32 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.9 (exc)
linux	linux_kernel	From 6.8 (inc) to 6.12.90 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's drm/msm/gem component, specifically in the function msm_ioctl_gem_info_get_metadata(). The function always returns 0 regardless of errors, meaning it signals success even when operations like copy_to_user() fail or the user buffer is too small.

Additionally, the function uses kmemdup() to allocate memory but does not check if the allocation failed (i.e., if kmemdup() returns NULL). This can lead to a NULL pointer dereference when copy_to_user() is called afterward.

The vulnerability causes userspace programs to incorrectly believe that the ioctl call succeeded when it actually failed, potentially leading to incorrect behavior or data handling.

Impact Analysis

Because the function msm_ioctl_gem_info_get_metadata() always returns success even when errors occur, userspace applications may proceed under false assumptions that data operations succeeded.

This can lead to incorrect application behavior, data corruption, or crashes due to the NULL pointer dereference caused by unchecked memory allocation failure.

Overall, the vulnerability undermines the reliability and stability of applications interacting with this kernel component.

Mitigation Strategies

To mitigate this vulnerability, update the Linux kernel to a version that includes the patch fixing the error handling in msm_ioctl_gem_info_get_metadata(). This patch adds the missing NULL check for kmemdup() and ensures the function returns the correct error code instead of always returning 0.

Until the update is applied, avoid using the affected ioctl (msm_ioctl_gem_info_get_metadata) in userspace applications to prevent potential issues caused by incorrect error reporting or NULL pointer dereferences.

Hi! I’m here to help you understand CVE-2026-46211. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70