CVE-2026-46211drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata()
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata() msm_ioctl_gem_info_get_metadata() always returns 0 regardless of errors. When copy_to_user() fails or the user buffer is too small, the error code stored in ret is ignored because the function unconditionally returns 0. This causes userspace to believe the ioctl succeeded when it did not. Additionally, kmemdup() can return NULL on allocation failure, but the return value is not checked. This leads to a NULL pointer dereference in the subsequent copy_to_user() call. Add the missing NULL check for kmemdup() and return ret instead of 0. Note that the SET counterpart (msm_ioctl_gem_info_set_metadata) correctly returns ret. Patchwork: https://patchwork.freedesktop.org/patch/714478/
- CVSS
- 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Analyzed
- Record last updated
- Jun 14, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 9902cb999e4e913d98e8afe4b36c08e4a793e1ce builds before 697e1a9559f6962f999cc4c748c2ffffcc0a7a7a; from 9902cb999e4e913d98e8afe4b36c08e4a793e1ce before c57c861956b89f2e2528e6384d51e2dedd915809; from 9902cb999e4e913d98e8afe4b36c08e4a793e1ce before b079e85c91f446f29e808d8291189e897f1884ff; 9902cb999e4e913d98e8afe4b36c08e4a793e1ce builds before 47cbfe2608314b833ad61a65827d8fb363bc2d2d | CNA record |
linux linux_kernel linux:linux_kernel | from 6.8 before 6.12.90; from 6.13 before 6.18.32; from 6.19 before 7.0.9 | NVD |
References
- https://git.kernel.org/stable/c/697e1a9559f6962f999cc4c748c2ffffcc0a7a7apatch
- https://git.kernel.org/stable/c/c57c861956b89f2e2528e6384d51e2dedd915809patch
- https://git.kernel.org/stable/c/b079e85c91f446f29e808d8291189e897f1884ffpatch
- https://git.kernel.org/stable/c/47cbfe2608314b833ad61a65827d8fb363bc2d2dpatch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.