CVE-2026-64049: Linux Kernel Adreno DoS Vulnerability

CVE-2026-64049 Overview

CVE-2026-64049 is a NULL pointer dereference vulnerability in the Linux kernel's drm/msm/adreno graphics driver. The flaw affects pre-a5xx Adreno GPU generations (a2xx through a4xx) that do not support Universal Bandwidth Compression (UBWC). Userspace applications can query UBWC-related parameters through adreno_get_param(), triggering a NULL pointer dereference because the driver does not initialize UBWC configuration for these generations. The fix adds a UBWC config check and returns sane defaults when the configuration is absent.

Critical Impact
Local unprivileged users can trigger a kernel NULL pointer dereference on affected Qualcomm Adreno GPU devices, resulting in denial of service through kernel crash.

Affected Products

Linux kernel drm/msm/adreno driver on devices using Adreno a2xx, a3xx, and a4xx GPU generations
Qualcomm Snapdragon SoC-based systems running affected kernel versions
Embedded and mobile Linux platforms using the MSM DRM driver

Discovery Timeline

2026-07-19 - CVE-2026-64049 published to NVD
2026-07-19 - Last updated in NVD database
Patchwork submission - Fix published to freedesktop.org patchwork 717778

Technical Details for CVE-2026-64049

Vulnerability Analysis

The vulnerability resides in the Adreno GPU driver path drm/msm/adreno, which supports multiple Qualcomm GPU generations. Adreno generations before a5xx do not implement UBWC, so the driver skips fetching UBWC parameters during initialization. However, the adreno_get_param() interface exposed to userspace does not gate UBWC-related parameter queries behind a hardware capability check.

When a userspace process queries a UBWC parameter on an a2xx, a3xx, or a4xx device, the driver dereferences a UBWC configuration pointer that was never populated. This results in a NULL pointer dereference in kernel context, crashing the kernel or oopsing the affected task. The issue is classified as a null pointer dereference [CWE-476] leading to a local denial of service.

Root Cause

The root cause is missing input validation in adreno_get_param(). The function accepts UBWC-related parameter identifiers regardless of whether the underlying hardware supports UBWC. Because pre-a5xx generations never allocate the UBWC configuration structure, the ensuing pointer access dereferences NULL. The patch introduces a check for the UBWC config and returns sane default values when no configuration exists.

Attack Vector

The attack vector is local. Any process with access to the DRM render node or /dev/dri/* device on a system with an affected Adreno GPU can issue the offending ioctl. No elevated privileges are required beyond the standard graphics device access typically granted to logged-in users or the graphics group. The trigger involves invoking the DRM parameter query ioctl with a UBWC-related parameter identifier on an unsupported GPU generation. Successful exploitation crashes the kernel rather than executing attacker-controlled code.

See the upstream commits 22fc33d, 2b4abf8, and eea43d5 for the applied fix.

Detection Methods for CVE-2026-64049

Indicators of Compromise

Kernel oops or panic entries in dmesg referencing adreno_get_param or msm_ioctl_get_param
Unexpected GPU driver reset events on Adreno a2xx, a3xx, or a4xx hardware
Repeated crashes of graphical sessions immediately after userspace parameter queries to the DRM device

Detection Strategies

Monitor kernel logs for NULL pointer dereference stack traces originating in the drm/msm/adreno module
Audit which userspace processes open /dev/dri/renderD* and /dev/dri/card* nodes on affected devices
Correlate DRM ioctl syscall patterns with subsequent kernel crash reports through host telemetry

Monitoring Recommendations

Forward kernel.log and journald records to a centralized log platform for pattern matching on adreno crash signatures
Track kernel version inventory across mobile and embedded Linux fleets to identify unpatched hosts
Alert on repeated kernel oops events on the same host, which may indicate probing or fuzzing activity

How to Mitigate CVE-2026-64049

Immediate Actions Required

Update affected Linux kernels to a version containing commits 22fc33d, 2b4abf8, or eea43d5
Inventory devices running Adreno a2xx, a3xx, or a4xx GPUs to prioritize patch deployment
Restrict access to DRM device nodes on multi-user systems where kernel updates are not yet available

Patch Information

The fix is applied in the upstream Linux kernel and merged through the stable trees. The patch modifies adreno_get_param() to verify the presence of UBWC configuration before dereferencing and returns sane defaults when no configuration exists. Reference the freedesktop.org patch discussion and the linked git.kernel.org commits for the exact code change. Distribution vendors should backport these commits to shipping kernel branches.

Workarounds

Limit membership of the video and render groups to trusted users on affected systems
Apply SELinux or AppArmor policies restricting DRM ioctl access on shared multi-user hosts
Disable or blacklist the msm DRM module on systems where GPU acceleration is not required

bash

# Verify kernel version and check for the patched adreno commit
uname -r
zcat /proc/config.gz | grep CONFIG_DRM_MSM
dmesg | grep -i adreno