CVE-2026-46278: drm/imagination: Fix segfault when updating ftrace mask
In the Linux kernel, the following vulnerability has been resolved:
drm/imagination: Fix segfault when updating ftrace mask
Fix invalid data access by passing right data for debugfs entry.
[ 171.549793] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 171.559248] Mem abort info: [ 171.562173] ESR = 0x0000000096000044 [ 171.566227] EC = 0x25: DABT (current EL), IL = 32 bits [ 171.573108] SET = 0, FnV = 0 [ 171.576448] EA = 0, S1PTW = 0 [ 171.579745] FSC = 0x04: level 0 translation fault [ 171.584760] Data abort info: [ 171.588012] ISV = 0, ISS = 0x00000044, ISS2 = 0x00000000 [ 171.593734] CM = 0, WnR = 1, TnD = 0, TagAccess = 0 [ 171.598962] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 171.604471] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000083837000 [ 171.611358] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 [ 171.618500] Internal error: Oops: 0000000096000044 [#1] SMP [ 171.624222] Modules linked in: powervr drmshmemhelper drmgpuvm... [ 171.656580] CPU: 0 UID: 0 PID: 549 Comm: bash Not tainted 7.0.0-rc2-g730b257ba723-dirty #13 PREEMPT [ 171.665773] Hardware name: BeagleBoard.org BeaglePlay (DT) [ 171.671296] pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 171.678306] pc : pvrfwtracemaskset+0x78/0x154 [powervr] [ 171.683959] lr : pvrfwtracemaskset+0x4c/0x154 [powervr] [ 171.689593] sp : ffff8000835ebb90 [ 171.692929] x29: ffff8000835ebc00 x28: ffff000005c60f80 x27: 0000000000000000 [ 171.700130] x26: 0000000000000000 x25: ffff00000504af28 x24: 0000000000000000 [ 171.707324] x23: ffff00000504af50 x22: 0000000000000203 x21: 0000000000000000 [ 171.714518] x20: ffff000005c44a80 x19: ffff000005c457b8 x18: 0000000000000000 [ 171.721715] x17: 0000000000000000 x16: 0000000000000000 x15: 0000aaaae8887580 [ 171.728908] x14: 0000000000000000 x13: 0000000000000000 x12: ffff8000835ebc30 [ 171.736095] x11: ffff00000504af2a x10: ffff00008504af29 x9 : 0fffffffffffffff [ 171.743286] x8 : ffff8000835ebbf8 x7 : 0000000000000000 x6 : 000000000000002a [ 171.750479] x5 : ffff00000504af2e x4 : 0000000000000000 x3 : 0000000000000010 [ 171.757674] x2 : 0000000000000203 x1 : 0000000000000000 x0 : ffff8000835ebba0 [ 171.764871] Call trace: [ 171.767342] pvrfwtracemaskset+0x78/0x154 [powervr] (P) [ 171.772984] simpleattrwritexsigned.isra.0+0xe0/0x19c [ 171.778341] simpleattrwrite+0x18/0x24 [ 171.782296] debugfsattrwrite+0x50/0x98 [ 171.786341] fullproxywrite+0x6c/0xa8 [ 171.790208] vfswrite+0xd4/0x350 [ 171.793561] ksyswrite+0x70/0x108 [ 171.796995] arm64syswrite+0x1c/0x28 [ 171.800952] invokesyscall+0x48/0x10c [ 171.804740] el0svccommon.constprop.0+0x40/0xe0 [ 171.809487] doel0svc+0x1c/0x28 [ 171.812834] el0svc+0x34/0x108 [ 171.816013] el0t64synchandler+0xa0/0xe4 [ 171.820237] el0t64sync+0x198/0x19c [ 171.823939] Code: 32000262 b90ac293 1a931056 9134e293 (b9000036) [ 171.830073] ---[ end trace 0000000000000000 ]---
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure the drm/imagination debugfs ftrace mask update path validates/uses the correct data so debugfs_attr_write does not dereference a NULL pointer (fix invalid data access by passing right data for the debugfs entry).
Linux kernel debugfs (drm/imagination debugfs entry) debugfs entry data handling = Pass right data for debugfs entry
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46278?
CVE-2026-46278 has a risk score of 37, indicating a moderate severity level.
Which software is affected by CVE-2026-46278?
CVE-2026-46278 affects the Linux kernel specifically in the drm/imagination powervr component.
What does CVE-2026-46278 aim to fix?
CVE-2026-46278 addresses a segmentation fault caused by a null pointer dereference when updating the ftrace mask.
How do I fix CVE-2026-46278?
To fix CVE-2026-46278, ensure that you update to the latest version of the Linux kernel where this vulnerability is patched.
What is a null pointer dereference as seen in CVE-2026-46278?
A null pointer dereference occurs when the program attempts to access memory at a null address, leading to a crash or undefined behavior.