CVE-2026-64231: drm/msm/dsi: don't dump registers past the mapped region

Q: Which systems are exposed to this issue?

The issue is described for Linux systems using the MSM DSI driver on DSI 6G platforms. The affected path is the display snapshot and register-memory dump handling.

Q: What access would an attacker need?

The CVSS vector indicates local access with low privileges is required. No user interaction is required.

Q: What is the impact if the vulnerable path is reached?

The register dump can access beyond the mapped I/O region because the dump size does not account for io_offset. The CVSS assessment rates the impact as high availability impact, with no confidentiality or integrity impact listed.

Q: What should be changed to remediate the problem?

Apply a kernel update containing the fix that reduces ctrl_size by io_offset before dumping the mapped register region. The provided stable-kernel references identify fixes for this issue.

Published Jul 24, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

drm/msm/dsi: don't dump registers past the mapped region

On DSI 6G platforms the IO address space is internally adjusted by iooffset. Later this adjusted address might be used for memory dumping. However the size that is used for memory dumping isn't adjusted to account for the iooffset, leading to the potential access to the unmapped region. Lower ctrlsize by the iooffset value to prevent access past the mapped area.

msmdispsnapshotaddblock+0x1d4/0x3c8 [msm] (P) msmdsihostsnapshot+0x4c/0x78 [msm] msmdsisnapshot+0x28/0x50 [msm] msmdispsnapshotcapturestate+0x74/0x140 [msm] msmdispsnapshotstatesync+0x60/0x90 [msm] msmdispsnapshotwork+0x30/0x90 [msm] kthreadworkerfn+0xdc/0x460 kthread+0x120/0x140

Patchwork: https://patchwork.freedesktop.org/patch/721747/

Affected Software

10 affected components

Linux Kernel

Linux Linux kernel>=5.14<6.1.175

Linux Linux kernel>=6.2<6.6.142

Linux Linux kernel>=6.7<6.12.92

Linux Linux kernel>=6.13<6.18.34

Linux Linux kernel>=6.19<7.0.11

Linux Linux kernel=7.1-rc1

Linux Linux kernel=7.1-rc2

Linux Linux kernel=7.1-rc3

Linux Linux kernel=7.1-rc4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade drm/msm/dsi: don't dump registers past the mapped region to a version that resolves this vulnerability.
Patch patchwork.freedesktop.org/patch/721747

Event History

Jul 24, 2026

CVE Published

via MITRE·03:23 PM

Data Sourced

via MITRE·03:23 PM

Description

Data Sourced

via NVD·04:16 PM

RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are exposed to this issue?

The issue is described for Linux systems using the MSM DSI driver on DSI 6G platforms. The affected path is the display snapshot and register-memory dump handling.

What access would an attacker need?

The CVSS vector indicates local access with low privileges is required. No user interaction is required.

What is the impact if the vulnerable path is reached?

The register dump can access beyond the mapped I/O region because the dump size does not account for io_offset. The CVSS assessment rates the impact as high availability impact, with no confidentiality or integrity impact listed.

What should be changed to remediate the problem?

Apply a kernel update containing the fix that reduces ctrl_size by io_offset before dumping the mapped register region. The provided stable-kernel references identify fixes for this issue.

CVE-2026-64231: drm/msm/dsi: don't dump registers past the mapped region

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What access would an attacker need?

What is the impact if the vulnerable path is reached?

What should be changed to remediate the problem?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What access would an attacker need?

What is the impact if the vulnerable path is reached?

What should be changed to remediate the problem?