CVE-2026-46211: drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata()
In the Linux kernel, the following vulnerability has been resolved:
drm/msm/gem: fix error handling in msmioctlgeminfogetmetadata()
msmioctlgeminfogetmetadata() always returns 0 regardless of errors. When copytouser() fails or the user buffer is too small, the error code stored in ret is ignored because the function unconditionally returns 0. This causes userspace to believe the ioctl succeeded when it did not.
Additionally, kmemdup() can return NULL on allocation failure, but the return value is not checked. This leads to a NULL pointer dereference in the subsequent copytouser() call.
Add the missing NULL check for kmemdup() and return ret instead of 0.
Note that the SET counterpart (msmioctlgeminfosetmetadata) correctly returns ret.
Patchwork: https://patchwork.freedesktop.org/patch/714478/
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
linux/kernel drm/msm/gemto a version that resolves this vulnerability.Patch 714478
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46211?
The severity of CVE-2026-46211 is assessed as 23.
How do I fix CVE-2026-46211?
To fix CVE-2026-46211, ensure that you apply the appropriate patch or update for the Linux kernel that addresses this vulnerability.
What vulnerabilities does CVE-2026-46211 address?
CVE-2026-46211 addresses the error handling issue in msm_ioctl_gem_info_get_metadata() in the Linux kernel.
Who is affected by CVE-2026-46211?
Any system running the affected versions of the Linux kernel with the drm/msm/gem module is vulnerable to CVE-2026-46211.
What component is impacted by CVE-2026-46211?
CVE-2026-46211 impacts the drm/msm/gem module in the Linux kernel.