CVE-2026-46211: Linux Kernel MSM DRM NULL Pointer and Silent Error in gem_info_get_metadata

Technical summary

The msm_ioctl_gem_info_get_metadata() function in the MSM DRM subsystem has two distinct error-handling defects. First, the function unconditionally returns 0 regardless of the value stored in the ret variable, which means errors from copy_to_user() (e.g., invalid buffer address, insufficient buffer size) are silently discarded. Second, kmemdup() is called without checking for NULL return on allocation failure; a subsequent copy_to_user() call on a NULL pointer triggers a NULL pointer dereference. The analogous SET metadata function correctly returns ret, highlighting that this GET function's behavior is inconsistent and unintentional. The fix involves adding a NULL check after kmemdup() and returning ret instead of hardcoded 0.

Business impact

For system administrators and application developers, this vulnerability means that userspace graphics applications may fail to detect when ioctl requests have actually failed, leading to silent data loss, corrupted application state, or assumption of invalid metadata. In memory-constrained environments or under high system load, the NULL pointer dereference can trigger a kernel panic affecting all users on that system. While the vulnerability requires local access and unprivileged userspace involvement, it degrades system reliability and complicates debugging of graphics-related failures.

Affected systems

The Linux kernel is affected. The vulnerability resides in the DRM (Direct Rendering Manager) subsystem's MSM (Qualcomm Adreno) GPU driver, specifically in the gem (Graphics Execution Manager) module. Any Linux distribution shipping an affected kernel version will include the vulnerable code. Systems running recent kernels with the MSM DRM driver compiled in are at risk. Server and desktop deployments with integrated or discrete Qualcomm Adreno GPUs are in scope.

Exploitability

Exploitation requires local code execution privilege (PR:L in CVSS) and no user interaction. An unprivileged local process can invoke the vulnerable ioctl and either trigger the NULL pointer dereference for a kernel panic, or exploit the silent error return to manipulate application behavior. The flaw is straightforward to trigger: calling the ioctl with a small or invalid buffer reliably reproduces the error-handling failure. No special kernel features, race conditions, or timing are required. However, the impact is localized to denial of service and denial of service only; remote exploitation and privilege escalation are not possible via this vector.

Remediation

Apply a kernel patch that adds a NULL pointer check after the kmemdup() call and modifies the function to return ret instead of 0. This is a minimal, localized fix that brings the GET metadata function in line with the SET metadata function's correct behavior. Affected distributions should backport the fix to all supported kernel versions that include the MSM DRM driver. End users should update their kernel to a patched version provided by their distribution.

Patch guidance

Check your Linux distribution's security advisory and kernel release notes for a patched version. The fix is expected to be included in forthcoming kernel releases. For RedHat, Ubuntu, Debian, and other major distributions, watch for kernel security updates addressing CVE-2026-46211. Verify patch version numbers against your vendor's official advisory before deployment. The fix is typically a single-digit line addition and should be safe to apply to stable kernel branches without substantial side effects.

Detection guidance

Monitor kernel logs for NULL pointer dereference crashes in the msm_ioctl_gem_info_get_metadata() path or caller stack traces involving gem metadata operations. Check for patterns where userspace DRM/graphics applications report unexpected failures or silently skip expected metadata checks. If using kernel tracing or eBPF, instrument the ioctl entry point to detect cases where the function returns 0 but internal error handling was triggered. Userspace fuzzing of the DRM ioctl interface, particularly gem_info operations, can provoke the condition.

Why prioritize this

This is a medium-severity issue affecting a niche but critical subsystem (GPU driver). The CVSS score of 5.5 reflects moderate impact (kernel denial of service) constrained by local-only attack surface. Prioritize patching for systems with integrated Adreno GPUs and active local user accounts. Server environments with graphics acceleration are at higher risk than headless deployments. The fix is simple and low-risk, making it a good candidate for prompt deployment.

Risk score, explained

CVSS 5.5 (MEDIUM) is justified by: (1) local attack vector only (AV:L), (2) low attack complexity—no special conditions needed (AC:L), (3) requires low privilege—unprivileged local process (PR:L), (4) no user interaction required (UI:N), (5) impact confined to the local system (S:U), (6) no confidentiality or integrity breach (C:N, I:N), but (7) high availability impact via NULL pointer dereference or denial of service (A:H). The vulnerability is not critical because remote exploitation is impossible and privilege escalation is not feasible through this vector alone.

Frequently asked questions