CVE-2026-93060: drm/msm/adreno: fix use after free on error path in a6xx_gpu_init()
In the Linux kernel, the following vulnerability has been resolved:
drm/msm/adreno: fix use after free on error path in a6xxgpuinit()
The a6xxdestroy() function frees "a6xxgpu" and so "adrenogpu" points to freed memory. Preserve the error code before freeing the memory to avoid a use after free.
Patchwork: https://patchwork.freedesktop.org/patch/732275/
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch 732275 - Configuration
Apply the drm/msm/adreno fix for use after free on the error path in a6xx_gpu_init() by preserving the error code before calling a6xx_destroy() (which frees a6xx_gpu, where adreno_gpu points), so the code path does not reference freed memory.
drm/msm/adreno (a6xx_gpu_init / a6xx_destroy) preserve error code before freeing memory = Preserve the error code before freeing a6xx_gpu to avoid use after free on adreno_gpu; fix error path to prevent use of freed memory
Event History
Frequently Asked Questions
When can this error-path issue be reached?
It is reached during a6xx_gpu_init() when initialization encounters an error and invokes a6xx_destroy(). The provided data does not identify the specific initialization failure that triggers this path.
What is the immediate technical consequence of the faulty cleanup path?
a6xx_destroy() frees a6xx_gpu, leaving adreno_gpu pointing to freed memory. Subsequent use of that pointer on the error path results in a use-after-free.
What does the fix change?
The fix preserves the error code before freeing the memory, preventing access through the freed adreno_gpu-related state after a6xx_destroy() runs.