Executive brief
A graphics driver for ARM Mali GPUs (lima) in the Linux kernel initializes virtual memory allocation before required parameters are configured, causing a kernel panic during driver initialization. This affects devices using ARM Mali4xx GPUs and prevents the graphics driver from loading when debug memory management is enabled.
Technical details
The vulnerability is a logic error in the lima GPU driver's device initialization code (lima_device_init). The driver calls lima_vm_create(), which invokes drm_mm_init() to set up memory allocation, before the va_start and va_end variables are initialized—both are 0 at that point. When DRM_DEBUG_MM debugging is enabled, drm_mm_init() performs a DRM_MM_BUG_ON validation check that fails with invalid allocation ranges, triggering a kernel BUG/panic. The fix simply reorders the initialization sequence: va_start and va_end are now configured before lima_vm_create() is called. This is a local denial of service affecting driver probe on specific ARM devices; no remote exploit or privilege escalation is possible.
Affected products
- Linux Linux kernel before 7.0.y stable; affects all versions with lima driver including 6.x, 5.x, 4.x branches
Timeline
- 2026-09-17: disclosed
- 2026-06-01: patched: Fix committed to mainline
- 2026-09-14: patched: Fix merged into stable trees