CVE-2026-93183: drm/lima: call drm_mm_init() with a valid allocation range
In the Linux kernel, the following vulnerability has been resolved:
drm/lima: call drmmminit() with a valid allocation range
limavmcreate() is currently run before vastart and vaend are set up, meaning they are both 0. limavmcreate() runs drmmminit() with them as arguments for the allocator, and if DRMDEBUGMM is enabled the DRMMMBUGON check in drmmminit then fires, as seen here on exynos4412-odroid-u2:
[ 1.736297] ------------[ cut here ]------------ [ 1.740370] kernel BUG at drivers/gpu/drm/drmmm.c:931! [ 1.745574] Internal error: Oops - BUG: 0 [#1] SMP ARM [ 1.750697] Modules linked in: [ 1.753734] CPU: 0 UID: 0 PID: 41 Comm: kworker/u16:1 Not tainted 7.0.10-postmarketos-exynos4 #11 PREEMPT [ 1.763372] Hardware name: Samsung Exynos (Flattened Device Tree) [ 1.769446] Workqueue: eventsunbound deferredprobeworkfunc [ 1.775261] PC is at drmmminit+0x9c/0xa4 [ 1.779339] LR is at limavmcreate+0x144/0x17c [ ... ]
Fix the issue by moving the limavmcreate() call after vastart and vaend are set up.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update lima_vm_create() so the va_start and va_end variables are initialized before calling drm_mm_init(). This prevents drm_mm_init() from running with them both equal to 0, which currently triggers the BUG at drivers/gpu/drm/drm_mm.c:931 when DRM_DEBUG_MM is enabled.
DRM (drivers/gpu/drm/drm_mm.c / lima) lima_vm_create() call ordering relative to va_start/va_end initialization = Call lima_vm_create() after va_start and va_end are set up (so drm_mm_init() receives a valid allocation range)
Event History
Frequently Asked Questions
Which systems are affected by the observed failure condition?
The failure was observed on a system using the Lima DRM driver, with DRM_DEBUG_MM enabled. The provided report shows it occurring during deferred device probing on an Exynos4412-based system.
How can administrators determine whether this issue has occurred?
Check kernel logs for a BUG or Oops at drm_mm_init(), with lima_vm_create() in the call trace. The report specifically shows a "kernel BUG at drivers/gpu/drm/drm_mm.c:931" message.
What change resolves the invalid allocator initialization?
The resolution is to invoke lima_vm_create() only after va_start and va_end have been initialized to a valid allocation range.