Executive brief
A vulnerability was identified in the Linux kernel's graphics driver for Qualcomm Adreno GPUs (MSM). The issue occurs when the system fails to properly release memory references during a specific graphics operation (VM_BIND) if an error occurs midway through the process. This could lead to a memory leak, potentially allowing a local user to cause a system crash or impact system stability.
Technical details
A reference counting vulnerability exists in the Linux kernel's drm/msm driver, specifically within the `vm_bind_job_lookup_ops` function in `drivers/gpu/drm/msm/msm_gem_vma.c`. When performing a bulk handle lookup for VM_BIND operations, if a lookup fails for one handle after others have already been successfully resolved and referenced via `drm_gem_object_get()`, the function fails to release the previously acquired references. This results in a kernel object leak. A local attacker with access to the DRM device could exploit this to exhaust kernel memory. The issue has been resolved by adding a cleanup loop in the error path to properly decrement the reference count of obtained objects using `drm_gem_object_put()`.
Affected products
- Linux Linux Kernel 6.17 to 6.17.2
Timeline
- 2025-08-20: patched: Initial patch authored by Rob Clark
- 2025-10-28: disclosed: CVE published