Executive brief
A vulnerability was identified in the Linux kernel's display driver for Qualcomm MSM chipsets. The issue occurs when the system attempts to take a 'snapshot' of the display state for debugging, where it incorrectly handles memory alignment for certain data regions. This could lead to improper memory access or system instability during diagnostic procedures.
Technical details
A vulnerability in the drm/msm/snapshot component of the Linux kernel was caused by the snapshotting code internally aligning data segments to 16 bytes. While this worked for DPU code, it failed for DSI data regions which are shifted by 4 bytes, leading to inaccurate register dumps. Additionally, the msm_disp_state_dump_regs() function suffered from a 16x memory overallocation bug. The fix involves removing the rigid length alignment and accurately calculating the remaining registers in unaligned regions. This is primarily a local stability and correctness issue reachable during display state debugging.
Affected products
- Linux Linux Kernel 5.14 to 5.15.209, 6.1.175, 6.6.142, 6.12.92
Timeline
- 2026-05-16: disclosed: Initial patch submitted to patchwork
- 2026-06-01: patched: Commits merged into stable branches
- 2026-07-19: advisory: CVE published and NVD record created
References
- https://git.kernel.org/stable/c/070e40acc59ef7bedba0314f59971ba87fcc8ab0
- https://git.kernel.org/stable/c/0c90ececfad3fc5c4c43a75ece0e2d736ab3def1
- https://git.kernel.org/stable/c/1ef79be774706dddcfcace0331fa7ff32a73c73e
- https://git.kernel.org/stable/c/76824d2467feb1828b745d6add2541918d7be3da
- https://git.kernel.org/stable/c/8fb070cf95847b29ef6cb15ec2c0de2bf4704676
- https://git.kernel.org/stable/c/cdd1aaf0ee962f50810b9aef7928f2313989d55f
- https://git.kernel.org/stable/c/cecd34e046121d788a70b5c8b4f8a88916637953