CVE-2026-64049: drm/msm/adreno: fix userspace-triggered crash on a2xx-a4xx
In the Linux kernel, the following vulnerability has been resolved:
drm/msm/adreno: fix userspace-triggered crash on a2xx-a4xx
Before a5xx Adreno driver will not try fetching UBWC params (because those generations didn't support UBWC anyway), however it's still possible to query UBWC-related params from the userspace, triggering possible NULL pointer dereference. Check for UBWC config in adrenogetparam() and return sane defaults if there is none.
Patchwork: https://patchwork.freedesktop.org/patch/717778/
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Upgrade/install the Linux kernel change referenced by Patchwork patch 717778 to fix the userspace-triggered crash (possible NULL pointer dereference) in drm/msm/adreno, which also ensures adreno_get_param() returns sane defaults when UBWC params are absent.
Event History
Frequently Asked Questions
Which systems are exposed to this crash?
Systems using the Linux kernel MSM Adreno driver for a2xx through a4xx GPU generations are exposed when userspace can query UBWC-related parameters. These GPU generations do not support UBWC, but the affected driver path could still attempt to retrieve UBWC configuration.
What access does an attacker need to trigger the issue?
An attacker needs local access with low privileges and the ability to issue the relevant userspace query to the affected Adreno driver. No user interaction is required.
What is the impact of successful exploitation?
The issue can cause a NULL pointer dereference in the kernel driver, resulting in a userspace-triggered system crash or denial of service. The provided CVSS vector indicates no confidentiality or integrity impact.
How can I tell whether a system has the fix?
Check whether the kernel includes one of the referenced stable commits: eea43d5ed45089705bc5d70971c39076962d5951, 22fc33d9b67694b24e0deb3f08c622464338cecb, or 2b4abf879360ea00a9e2b46d2d15dcdbc0687eed. The fix makes adreno_get_param() check for UBWC configuration and return safe defaults when none is present.