PT-2026-44334 · Linux · Linux

Published 2026-05-28 · Updated 2026-05-28 · CVE-2026-46211

Mitre

In the Linux kernel, the following vulnerability has been resolved:

drm/msm/gem: fix error handling in msm ioctl gem info get metadata()

msm ioctl gem info get metadata() always returns 0 regardless of errors. When copy to user() fails or the user buffer is too small, the error code stored in ret is ignored because the function unconditionally returns 0. This causes userspace to believe the ioctl succeeded when it did not.

Additionally, kmemdup() can return NULL on allocation failure, but the return value is not checked. This leads to a NULL pointer dereference in the subsequent copy to user() call.

Add the missing NULL check for kmemdup() and return ret instead of 0.

Note that the SET counterpart (msm ioctl gem info set metadata) correctly returns ret.

Patchwork: https://patchwork.freedesktop.org/patch/714478/

Related Identifiers

CVE-2026-46211

Affected Products

Linux

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-46211 · Security Note
• https://git.kernel.org/stable/c/b079e85c91f446f29e808d8291189e897f1884ff · Note
• https://git.kernel.org/stable/c/c57c861956b89f2e2528e6384d51e2dedd915809 · Note
• https://git.kernel.org/stable/c/47cbfe2608314b833ad61a65827d8fb363bc2d2d · Note
• https://git.kernel.org/stable/c/697e1a9559f6962f999cc4c748c2ffffcc0a7a7a · Note