Executive brief
The Linux kernel's drm/msm graphics driver improperly handles scheduler initialization failures when setting up GPU command rings. If the scheduler initialization fails partway through, the cleanup code attempts to finalize an incompletely initialized scheduler state, causing a kernel panic or memory corruption. This affects systems using Qualcomm Adreno GPUs that rely on the drm/msm driver for graphics output.
Technical details
This vulnerability is a resource cleanup logic error in msm_ringbuffer_new() within the drm/msm graphics driver. When drm_sched_init() fails before completing initialization, the error path calls drm_sched_fini() unconditionally, but that function assumes all scheduler data structures (work queues, lists, work items) are fully initialized. The fix tracks successful initialization with a boolean flag (sched_initialized) and only calls drm_sched_fini() if initialization completed. No remote network vector; affects only systems attempting to load the drm/msm driver during boot or GPU initialization. The issue was identified by static analysis and confirmed manually.
Affected products
- Linux Linux kernel All versions with drm/msm graphics driver prior to 2026-07-09
Timeline
- 2026-09-17: disclosed: CVE-2026-93058 published
- 2026-07-09: patched: Fix authored by Ruoyu Wang (commit e2332abed2a4d3caa59052095dc16e4ce44791ea)