CVE-2026-93183: drm/lima: call drm_mm_init() with a valid allocation range
drm/lima: call drmmminit() with a valid allocation range
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1 - Configuration
Update lima_vm_create() so the va_start and va_end variables are initialized before calling drm_mm_init(). This prevents drm_mm_init() from running with them both equal to 0, which currently triggers the BUG at drivers/gpu/drm/drm_mm.c:931 when DRM_DEBUG_MM is enabled.
DRM (drivers/gpu/drm/drm_mm.c / lima) lima_vm_create() call ordering relative to va_start/va_end initialization = Call lima_vm_create() after va_start and va_end are set up (so drm_mm_init() receives a valid allocation range)
Event History
Frequently Asked Questions
Which systems are affected by the observed failure condition?
The failure was observed on a system using the Lima DRM driver, with DRM_DEBUG_MM enabled. The provided report shows it occurring during deferred device probing on an Exynos4412-based system.
How can administrators determine whether this issue has occurred?
Check kernel logs for a BUG or Oops at drm_mm_init(), with lima_vm_create() in the call trace. The report specifically shows a "kernel BUG at drivers/gpu/drm/drm_mm.c:931" message.
What change resolves the invalid allocator initialization?
The resolution is to invoke lima_vm_create() only after va_start and va_end have been initialized to a valid allocation range.