Executive brief
A vulnerability was identified in the Linux kernel's graphics driver for Qualcomm Adreno GPUs (MSM). A technical error in how the system handles memory unmapping could lead to improper locking of memory objects. This could potentially allow a local attacker to cause system instability or interfere with memory shared between different processes.
Technical details
A vulnerability in the Linux kernel's DRM driver for MSM devices (drivers/gpu/drm/msm/msm_gem_vma.c) stems from an incorrect argument passed to the locking function during VM_BIND UNMAP operations. Specifically, the code incorrectly used 'op->obj_offset' instead of 'op->range' when calling 'drm_gpuvm_sm_unmap_exec_lock'. This resulted in memory objects (BOs) involved in UNMAP operations not being properly locked, particularly for non-_NO_SHARE objects that do not share a common reservation object with the VM. This race condition or synchronization failure could be exploited by a local user to cause kernel instability. The issue has been patched in stable branches including 6.18.33 and 7.0.10.
Affected products
- Linux Linux 6.17 to 6.18.33, 7.0.10
Timeline
- 2026-03-24: disclosed: Initial patch submitted to patchwork
- 2026-06-24: advisory: NVD publication date