CVE-2026-46247: Linux Kernel GFX3D Clock Driver Denial-of-Service Vulnerability

Technical summary

CVE-2026-46247 is a null pointer dereference or missing data structure initialization in the Qualcomm GFX3D clock driver (drivers/clk/qcom/clk-rcg2.c). The root cause lies in commit d228ece36345, which refactored the divider clock's rate determination logic from round_rate() to determine_rate(). The new code path expects the parent_req structure to contain a populated best_parent_hw field, but the GFX3D driver's clk_gfx3d_determine_rate() function fails to set this field when constructing the parent clock request. When clk_divider_bestdiv() is later invoked via the call chain triggered by dev_pm_opp_set_rate() (the operating point voting mechanism), it attempts to dereference an uninitialized or NULL best_parent_hw pointer, causing a kernel crash. The fix involves ensuring that the parent_req structure's best_parent_hw field is populated alongside the primary request structure during clock rate determination.

Business impact

While this vulnerability does not lead to privilege escalation or data theft, it causes a denial-of-service condition on affected devices. The crash occurs during GPU frequency scaling, which is triggered by the system's devfreq power management framework. On mobile and embedded devices using Qualcomm SoCs, this can result in GPU lockups, rendering the device unusable or forcing a reboot. For server environments or edge compute platforms relying on Qualcomm processors, unplanned kernel panics disrupt service availability. The vulnerability is particularly problematic because it strikes at a fundamental device operation (power-efficient GPU throttling) that occurs frequently during normal use, making workarounds difficult without kernel patching.

Affected systems

The vulnerability affects Linux kernel systems using Qualcomm's GFX3D GPU clock driver, present on Snapdragon and similar Qualcomm SoC-based devices. This includes Android smartphones and tablets, IoT edge devices, automotive platforms, and specialized embedded systems that rely on Qualcomm processors with integrated GPUs. The specific affected kernel versions are those that include commit d228ece36345 and the vulnerable GFX3D driver code without the fix applied. Desktop and server systems using non-Qualcomm GPUs or kernels without the affected clock driver code are not impacted.

Exploitability

Exploitability is limited by the local-only attack vector and requirement for unprivileged user privilege (PR:L in the CVSS vector). A local user must trigger GPU frequency scaling to manifest the crash; this naturally occurs during GPU workloads or can be induced by calling clock rate adjustment APIs. The crash is highly reliable once triggered, but weaponization for malicious denial-of-service requires local system access. There is no remote exploitation path, and the vulnerability cannot be leveraged for code execution or information disclosure. The vulnerability is fundamentally a logic bug rather than a memory corruption flaw.

Remediation

The fix is straightforward: ensure the parent_req structure's best_parent_hw field is set when the GFX3D driver constructs parent clock requests. This typically involves populating parent_req with the same parent hardware clock information used in the primary request structure. The kernel maintainers have resolved this in subsequent patches to the clk-rcg2.c driver. Organizations should apply the patched kernel version provided by their device vendor or kernel distribution. For Qualcomm-based device manufacturers, coordinate with Qualcomm and upstream kernel maintainers to obtain and integrate the fix. Until patching is feasible, users should avoid intensive GPU workloads that trigger frequency scaling, though this is rarely a practical long-term mitigation.

Patch guidance

Identify the kernel version running on affected devices using 'uname -r' or equivalent. Check the Qualcomm and linux-kernel security advisories for patched versions addressing CVE-2026-46247. For Android devices, updates typically come through device manufacturer security patches; contact your OEM for availability. For custom kernel deployments, apply the fix from upstream linux-kernel repositories or Qualcomm's BSP (Board Support Package) release. Verify the applied patch by confirming that the parent_req.best_parent_hw field is populated in the clk_gfx3d_determine_rate() function. Test that GPU frequency scaling operates normally post-patch by running GPU-intensive workloads and monitoring system stability.

Detection guidance

Monitor kernel logs for panic or oops messages mentioning clk_gfx3d_determine_rate, clk_divider_bestdiv, or devfreq/GPU clock operations. Search for crashes occurring in the call chain: msm_devfreq_target → dev_pm_opp_set_rate → clock rate rounding. On affected systems, enable detailed GPU/clock tracing using kernel tracepoints (trace_clk_round_rate, trace_devfreq_target) to capture the exact conditions triggering the crash. System monitoring tools may alert on unexpected GPU state changes or kernel panics during routine operation. Device telemetry showing repeated GPU thermal throttling attempts followed by system resets suggests the vulnerability is being triggered.

Why prioritize this

Assign this vulnerability medium-to-high priority for any Qualcomm SoC-based deployments, particularly those running sustained GPU workloads. The CVSS 5.5 (MEDIUM) rating reflects the local-only attack surface and denial-of-service impact, yet the practical severity is elevated because the crash occurs during normal device operation (power management) rather than requiring deliberate exploitation. For production mobile and edge computing environments, kernel stability is paramount; a crash during routine GPU frequency adjustment is unacceptable. Prioritize patching for user-facing devices and public-facing edge compute clusters first, then extend to development and lab environments.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects: Attack Vector (Local)—requires local access; Attack Complexity (Low)—no special conditions needed to trigger; Privileges Required (Low)—unprivileged user can cause the crash; User Interaction (None)—no user action required beyond normal GPU usage; Scope (Unchanged)—impact limited to the affected system; Confidentiality/Integrity (None)—no data exposure or corruption; Availability (High)—reliable denial-of-service via kernel panic. The score appropriately captures the limited attack surface but does not fully convey the operational impact of crashes during normal power management, which organizations should weigh in their own risk assessments.

Frequently asked questions