CVE-2026-64049
Received Received - Intake

Kernel Crash in Adreno GPU Driver Due to UBWC Parameter Handling

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: drm/msm/adreno: fix userspace-triggered crash on a2xx-a4xx Before a5xx Adreno driver will not try fetching UBWC params (because those generations didn't support UBWC anyway), however it's still possible to query UBWC-related params from the userspace, triggering possible NULL pointer dereference. Check for UBWC config in adreno_get_param() and return sane defaults if there is none. Patchwork: https://patchwork.freedesktop.org/patch/717778/

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64049
EUVD
EUVD-2026-45622

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
freedesktop linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's Adreno GPU driver for a2xx-a4xx series. It allows userspace to query UBWC-related parameters even though these GPU generations don't support UBWC, potentially causing a NULL pointer dereference and system crash.

Detection Guidance

This vulnerability is specific to the Linux kernel's Adreno GPU driver (drm/msm/adreno) and requires kernel-level detection. Check if your system uses affected Adreno GPU generations (a2xx-a4xx) by examining kernel logs for GPU-related errors or crashes. Look for NULL pointer dereference messages in dmesg or system logs.

Impact Analysis

An attacker with local access could trigger this flaw to crash the system, leading to denial of service. It requires user interaction but could disrupt services or cause instability on affected Linux systems.

Compliance Impact

This vulnerability is a local kernel crash triggered by userspace queries and does not involve data exposure or processing. It is unlikely to directly impact compliance with GDPR, HIPAA, or similar standards since no data breach or unauthorized access occurs.

Mitigation Strategies

Apply the kernel patch referenced in the CVE (Patchwork link provided). Update your Linux kernel to a version that includes the fix. If immediate patching is not possible, restrict access to GPU-related ioctls or userspace interfaces that could trigger the vulnerability until the patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64049. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart