CVE-2026-64039: drm/msm/snapshot: fix dumping of the unaligned regions
In the Linux kernel, the following vulnerability has been resolved:
drm/msm/snapshot: fix dumping of the unaligned regions
The snapshotting code internally aligns data segment to 16 bytes. This works fine for DPU code (where most of the regions are aligned), but fails for snapshotting of the DSI data (because DSI data region is shifted by 4 bytes). Fix the code by removing length alignment and by accurately printing last registers in the region. While reworking the code also fix the 16x memory overallocation in msmdispstatedumpregs().
Patchwork: https://patchwork.freedesktop.org/patch/725449/
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the DRM MSM snapshotting code, remove the 16-byte data-segment length alignment so unaligned regions, including the DSI data region shifted by 4 bytes, are dumped accurately and the 16x memory overallocation in msm_disp_state_dump_regs() is avoided.
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The vulnerability is rated as locally exploitable with low attack complexity. The vector indicates no privileges or user interaction are required.
Which display snapshot paths are most relevant to this issue?
The failure is specifically associated with snapshotting DSI data, whose region is shifted by 4 bytes and can be unaligned. DPU snapshot regions are generally aligned and the existing behavior works for most of them.
What is the potential security impact?
The supplied severity vector indicates high confidentiality and availability impact, with no integrity impact.