Executive brief
A vulnerability in the Linux kernel's Imagination Technologies graphics driver can cause the system to crash (segmentation fault) when a privileged user attempts to update certain tracing settings. This issue affects the stability of the operating system but does not directly expose customer data. An exploit would typically result in a denial-of-service condition, requiring a system reboot to recover.
Technical details
A NULL pointer dereference exists in the 'drm/imagination' driver within the 'pvr_fw_trace_mask_set' function. The vulnerability is caused by passing incorrect data structures to a debugfs entry ('trace_mask') during initialization in 'pvr_fw_trace_debugfs_init'. When a user with sufficient privileges (typically root) writes to this debugfs file, the kernel attempts to access an invalid memory address, leading to a kernel oops and system crash. The fix involves passing the correct 'pvr_dev' structure instead of 'fw_trace' to the 'debugfs_create_file' call. Patches have been released in the stable kernel tree.
Affected products
- Linux Linux Kernel 7.0.0-rc2-g730b257ba723-dirty
Timeline
- 2026-04-27: patched: Initial fix committed to imagination driver.
- 2026-06-08: advisory: CVE-2026-46278 published.