Executive brief
A bug in the Linux kernel's graphics driver for Qualcomm Adreno GPUs can cause the system to access freed memory when initialization fails. This could lead to kernel crashes or instability on devices using Adreno graphics hardware, affecting availability of the system.
Technical details
The vulnerability is a use-after-free in the a6xx_gpu_init() function within the DRM MSM Adreno driver. When qcom_ubwc_config_get_data() returns an error, the error code is dereferenced after a6xx_destroy() has freed the associated memory structure, causing the function to access freed memory. The fix captures the error code (PTR_ERR) before calling a6xx_destroy(), then returns the saved error code instead of dereferencing the freed pointer. This is a local kernel bug triggered during GPU initialization failure on systems with Adreno GPUs. A patch is already available in the Linux kernel stable tree.
Affected products
- Linux Linux kernel affected versions include Linux 5.x and 6.x, exact range determined by when d158886cba08 was introduced
Timeline
- 2026-09-17: disclosed
- 2026-07-16: patched: upstream fix merged by Rob Clark