Executive brief
A vulnerability was identified in the Linux kernel's graphics driver for Qualcomm Adreno GPUs. The issue involves incorrect error handling when applications request memory metadata, which could lead to a system crash (NULL pointer dereference) or cause applications to incorrectly believe a failed operation was successful. This primarily impacts system stability and the reliability of graphics-heavy applications on affected hardware.
Technical details
A vulnerability exists in the msm_ioctl_gem_info_get_metadata() function within the Linux kernel's MSM DRM driver (drivers/gpu/drm/msm/msm_drv.c). The function failed to check the return value of kmemdup(), leading to a NULL pointer dereference during a subsequent copy_to_user() call if memory allocation failed. Additionally, the function incorrectly returned 0 (success) even when internal errors occurred or user buffers were insufficient, potentially misleading userspace processes. Local attackers or malfunctioning applications could trigger a kernel oops by forcing allocation failures or providing invalid parameters to the affected ioctl. The issue has been resolved by adding proper NULL checks and ensuring the function returns the appropriate error code.
Affected products
- Linux Linux kernel All versions prior to the fixed commits in May 2026
Timeline
- 2026-03-25: other: Patch submitted by developer
- 2026-05-28: advisory: NVD publication date