CVE-2026-64039: Linux Kernel MSM Snapshot Vulnerability

CVE-2026-64039 Overview

CVE-2026-64039 affects the Linux kernel's Direct Rendering Manager (DRM) driver for Qualcomm MSM display hardware. The vulnerability resides in the display snapshot code path within drm/msm/snapshot, which internally aligns data segments to 16 bytes. This alignment works correctly for Display Processing Unit (DPU) regions but breaks when snapshotting Display Serial Interface (DSI) data because the DSI region is shifted by 4 bytes. The flaw also involves a 16x memory overallocation in msm_disp_state_dump_regs(). Local attackers with the ability to trigger snapshotting can leverage the misalignment and overallocation to impact system availability on affected Linux kernel builds.

Critical Impact
Local exploitation of the unaligned region handling in the MSM DRM snapshot code can result in memory corruption and denial of service on affected Linux systems.

Affected Products

Linux kernel — drm/msm display driver subsystem
Systems using Qualcomm MSM DPU and DSI display hardware
Multiple stable kernel branches receiving the backported fix

Discovery Timeline

2026-07-19 - CVE-2026-64039 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64039

Vulnerability Analysis

The vulnerability exists in the Linux kernel's drm/msm snapshot subsystem, which captures register state for debugging display hardware. The snapshotting code aligns data segments to 16-byte boundaries when writing region contents. DPU register regions are naturally aligned, so the code operated correctly for that case. DSI register regions are offset by 4 bytes from the assumed alignment, so the length alignment produced incorrect boundaries when dumping DSI data.

A second defect compounds the issue. The helper msm_disp_state_dump_regs() allocates 16 times more memory than required for the register dump buffer. This overallocation increases kernel memory pressure and, combined with the alignment bug, results in out-of-bounds behavior when the last registers in a region are printed. The upstream fix removes length alignment, prints the last registers accurately, and corrects the buffer sizing in msm_disp_state_dump_regs().

Root Cause

The root cause is improper handling of region length alignment in the display snapshot code. The code assumed all register regions were 16-byte aligned, but DSI regions violate that assumption. The overallocation stems from a size calculation error in msm_disp_state_dump_regs() that multiplied the required buffer by a factor of 16.

Attack Vector

Exploitation requires local access to a Linux system running an affected kernel with the MSM DRM driver active. An attacker with permissions to trigger a display state snapshot can invoke the vulnerable code path. The CVSS vector indicates low attack complexity, no privileges required beyond the trigger permission, no user interaction, and high impact on confidentiality and availability. See the Patchwork submission for technical detail on the fix.

See the upstream kernel commits referenced below for the exact code changes.
No verified public exploitation code is available for CVE-2026-64039.

Detection Methods for CVE-2026-64039

Indicators of Compromise

Unexpected kernel messages or crashes originating from the drm/msm subsystem when display snapshots are triggered
Abnormally large kernel memory allocations tied to msm_disp_state_dump_regs()
Kernel oops or panic traces referencing DSI register region dumping

Detection Strategies

Compare running kernel version and build against the fixed commits listed in the kernel stable tree
Monitor dmesg and journal logs for repeated invocations of DRM snapshot code paths from unprivileged contexts
Audit which local accounts and services can trigger display state dumps on Qualcomm-based Linux devices

Monitoring Recommendations

Alert on unexpected kernel crashes or GPU driver faults on Qualcomm MSM hardware
Track kernel package versions across the fleet to identify unpatched systems running vulnerable drm/msm code
Log local process activity that interacts with DRM debug interfaces under /sys/kernel/debug/dri

How to Mitigate CVE-2026-64039

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable tree commits for CVE-2026-64039
Update to a kernel package version from your distribution that includes the fix for drm/msm/snapshot
Restrict local access to systems using the MSM DRM driver until patches are deployed

Patch Information

The fix is available in the Linux kernel stable tree across multiple branches. Reference commits include 070e40acc59e, 0c90ececfad3, 1ef79be77470, 76824d2467fe, 8fb070cf9584, cdd1aaf0ee96, and cecd34e04612. See the Linux kernel stable commit for the primary change.

Workarounds

Restrict access to DRM debug interfaces by tightening permissions on /sys/kernel/debug/dri where feasible
Limit which users and services can trigger display state snapshots on affected devices
Disable the MSM DRM debug snapshot functionality in custom kernel builds where the feature is not required

bash

# Verify installed kernel version and check for the fix
uname -r
# Confirm distribution package includes the drm/msm snapshot fix
# Example for Debian/Ubuntu:
apt-cache policy linux-image-$(uname -r)
# Restrict debugfs access to root only
mount -o remount,mode=700 /sys/kernel/debug