Medium 5.5Published Jul 24, 2026

CVE-2026-64231drm/msm/dsi: don't dump registers past the mapped region

Updated under an hour ago (Oct 26, 2026, 5:30 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dsi: don't dump registers past the mapped region On DSI 6G platforms the IO address space is internally adjusted by io_offset. Later this adjusted address might be used for memory dumping. However the size that is used for memory dumping isn't adjusted to account for the io_offset, leading to the potential access to the unmapped region. Lower ctrl_size by the io_offset value to prevent access past the mapped area. msm_disp_snapshot_add_block+0x1d4/0x3c8 [msm] (P) msm_dsi_host_snapshot+0x4c/0x78 [msm] msm_dsi_snapshot+0x28/0x50 [msm] msm_disp_snapshot_capture_state+0x74/0x140 [msm] msm_disp_snapshot_state_sync+0x60/0x90 [msm] _msm_disp_snapshot_work+0x30/0x90 [msm] kthread_worker_fn+0xdc/0x460 kthread+0x120/0x140 Patchwork: https://patchwork.freedesktop.org/patch/721747/

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Jul 24, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from bac2c6a62ed91ba4f6c7c14a6a40b7c696b35645 before 5e2c196c3430fb94225c4102b1028d0146544761; from bac2c6a62ed91ba4f6c7c14a6a40b7c696b35645 before 567b5e976e2e15280d78c9ef2add1954a0bbb5b1; from bac2c6a62ed91ba4f6c7c14a6a40b7c696b35645 before 9f8274749d9010a1a72f97e547b7eb9ebb82345b; from bac2c6a62ed91ba4f6c7c14a6a40b7c696b35645 before a184aec790135938b0fadb415e55accd1f8685a0; from bac2c6a62ed91ba4f6c7c14a6a40b7c696b35645 before ab871d5882953e5574ae2bc47bec88c2e3d22663; from bac2c6a62ed91ba4f6c7c14a6a40b7c696b35645 before 5b49a46baa853b26dbefa65c6c75dd9ff69f63d4	CNA record
linux linux_kernel linux:linux_kernel	from 5.14 before 6.1.175; from 6.2 before 6.6.142; from 6.7 before 6.12.92; from 6.13 before 6.18.34; from 6.19 before 7.0.11; 7.1; 7.1; 7.1; and 1 more ranges	NVD

References

References

https://git.kernel.org/stable/c/5e2c196c3430fb94225c4102b1028d0146544761	patch
https://git.kernel.org/stable/c/567b5e976e2e15280d78c9ef2add1954a0bbb5b1	patch
https://git.kernel.org/stable/c/9f8274749d9010a1a72f97e547b7eb9ebb82345b	patch
https://git.kernel.org/stable/c/a184aec790135938b0fadb415e55accd1f8685a0	patch
https://git.kernel.org/stable/c/ab871d5882953e5574ae2bc47bec88c2e3d22663	patch
https://git.kernel.org/stable/c/5b49a46baa853b26dbefa65c6c75dd9ff69f63d4	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.