CVE-2026-64050

Analyzed Analyzed - Analysis Complete

Use-After-Free in Linux Kernel MSM DPU Driver

Publication date: 2026-07-19

Last updated on: 2026-09-02

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: don't mix devm and drmm functions Mixing devm and drmm functions will result in a use-after-free on msm driver teardown if userspace keeps a reference on the drm device: The WB connector data will be destroyed because of the use of devm_kzalloc()), while the usersoace still can try interacting with the WB connector (which uses drmm_ functions). Change dpu_writeback_init() to use drmm_. Patchwork: https://patchwork.freedesktop.org/patch/722656/

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-09-02

Generated

2026-09-18

AI Q&A

2026-07-19

EPSS Evaluated

2026-09-15

NVD

CVE-2026-64050

EUVD

EUVD-2026-45623

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.19 (inc) to 7.0.11 (exc)
linux	linux_kernel	From 6.18 (inc) to 6.18.34 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability involves a mix of devm and drmm functions in the Linux kernel's msm driver. Using both types of functions can cause a use-after-free issue when the driver is torn down. Specifically, the WB connector data may be destroyed prematurely while userspace still holds a reference, leading to potential crashes or instability.

Detection Guidance

This vulnerability is specific to the Linux kernel's msm driver and requires kernel-level inspection. Detection involves checking kernel logs for use-after-free errors related to the drm/msm/dpu WB connector. Use dmesg | grep -i 'use-after-free' or dmesg | grep -i 'WB connector' to identify issues. Ensure your kernel version includes the patch for CVE-2026-64050.

Impact Analysis

If you use a system with the affected Linux kernel, this vulnerability could cause system instability or crashes when the msm driver is unloaded. It may lead to data corruption or unexpected behavior if userspace applications interact with the WB connector after it has been freed.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a use-after-free issue in the Linux kernel's msm driver, which could lead to system instability or crashes but does not involve data breaches or unauthorized access.

Mitigation Strategies

Update your Linux kernel to a patched version that includes the fix for CVE-2026-64050. If immediate patching is not possible, disable the msm driver or WB connector functionality as a temporary workaround. Monitor kernel logs for use-after-free errors post-update.

Hi! I’m here to help you understand CVE-2026-64050. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70