CVE-2026-64050: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64050 Overview

CVE-2026-64050 is a use-after-free vulnerability in the Linux kernel's Direct Rendering Manager (DRM) subsystem, specifically in the Qualcomm Mobile Display Processing Unit (drm/msm/dpu) driver. The flaw stems from mixing devm_ (device-managed) and drmm_ (DRM-managed) allocation lifecycles inside dpu_writeback_init(). When the msm driver tears down while userspace still holds a reference to the DRM device, the writeback (WB) connector data allocated with devm_kzalloc() is freed prematurely, while userspace can still interact with the WB connector that relies on drmm_ functions. The fix converts dpu_writeback_init() to use drmm_ allocation to align object lifetimes with the DRM device.

Critical Impact
Local low-privileged users can trigger a use-after-free during driver teardown, enabling potential kernel memory corruption, privilege escalation, or denial of service on affected msm-based systems.

Affected Products

Linux kernel builds including the drm/msm/dpu (Qualcomm MSM Display Processing Unit) driver prior to the fix
Qualcomm Snapdragon platforms using the msm DRM driver with writeback connector support
Downstream distribution kernels that had not yet backported commits 95048a12f48c, c0c70a11365c, or ff58e5ef1b46

Discovery Timeline

2026-07-19 - CVE-2026-64050 published to the National Vulnerability Database (NVD)
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64050

Vulnerability Analysis

The Linux kernel provides two distinct resource-management APIs relevant to this defect. The devm_ family ties allocations to the underlying struct device lifecycle, while the drmm_ family ties allocations to the struct drm_device lifecycle. These lifetimes are not equivalent when userspace retains an open file descriptor on a DRM device after the underlying device has been unbound.

In dpu_writeback_init(), the writeback connector's backing memory was allocated with devm_kzalloc(). During driver teardown, the device-managed memory is released as soon as the device goes away. However, the DRM device can outlive the underlying platform device when userspace holds an open reference, and the writeback connector continues to be reachable through drmm_-registered callbacks. Subsequent ioctl or file operations dereference freed connector state, producing a classic use-after-free [CWE-416].

Root Cause

The root cause is a lifetime mismatch between two resource-management frameworks. Objects logically owned by the DRM device were allocated with device-scoped helpers, causing them to be freed before the DRM device itself is destroyed. The upstream fix migrates dpu_writeback_init() to drmm_ helpers so the writeback connector memory is released only when the DRM device is torn down.

Attack Vector

Exploitation requires local access with the ability to open the /dev/dri/cardN node and hold a reference across driver teardown. An unprivileged user can open the DRM device, retain the file descriptor, and then trigger driver unbind or a rebind sequence. Once the devm_-backed memory is released, further connector operations from the still-open handle dereference stale pointers. The high confidentiality, integrity, and availability impact reflects the ability of kernel-space use-after-free conditions to be shaped into privilege escalation on suitable hardware.

No verified public exploit code is available. Refer to the upstream commits for the exact code paths and remediation details.

Detection Methods for CVE-2026-64050

Indicators of Compromise

Kernel BUG:, KASAN: use-after-free, or general protection fault messages referencing dpu_writeback, drm_connector, or msm_drm symbols in dmesg
Unexpected crashes or panics on Qualcomm Snapdragon devices when unbinding, rebinding, or hot-unplugging the display driver while a DRM client is active
Coincident open handles on /dev/dri/card* from unprivileged processes at the moment of driver teardown

Detection Strategies

Enable CONFIG_KASAN on test kernels and stress drm/msm bind/unbind cycles while a userspace client holds the DRM device open
Audit loaded kernel version and patch level against upstream commits 95048a12f48c, c0c70a11365c, and ff58e5ef1b46
Correlate DRM-related oopses with process activity to identify low-privileged callers touching the writeback connector

Monitoring Recommendations

Forward kernel logs (journald, rsyslog) to a central SIEM and alert on KASAN, use-after-free, or msm/dpu_writeback panic signatures
Track kernel package versions across the fleet and flag hosts running unpatched linux-image builds on Qualcomm hardware
Monitor for repeated driver unbind/rebind operations from non-root users, which is unusual on production endpoints

How to Mitigate CVE-2026-64050

Immediate Actions Required

Upgrade to a Linux kernel build that includes the upstream fix commits 95048a12f48c627b, c0c70a11365cba7f, and ff58e5ef1b46ce61
On distribution kernels, apply the vendor security update as soon as it is published for your kernel branch
Restrict access to /dev/dri/card* nodes to trusted users and groups where feasible to reduce local attack surface

Patch Information

The fix changes dpu_writeback_init() to allocate the writeback connector using drmm_ helpers, aligning object lifetime with the DRM device. Patches are available in the upstream stable tree via the kernel.org commit 95048a12f48c, kernel.org commit c0c70a11365c, and kernel.org commit ff58e5ef1b46. The associated review thread is on freedesktop.org Patchwork 722656.

Workarounds

Avoid unbinding or rebinding the msm DRM driver on production systems until the patched kernel is deployed
Limit membership in the video group and any group with access to DRM device nodes on multi-user systems
Where writeback functionality is not required, evaluate building kernels without the affected writeback path enabled

bash

# Verify the running kernel and installed package version
uname -r

# Debian/Ubuntu
apt list --installed 2>/dev/null | grep linux-image

# Fedora/RHEL
rpm -q kernel

# Restrict DRM device access to the video group
ls -l /dev/dri/
sudo chown root:video /dev/dri/card*
sudo chmod 0660 /dev/dri/card*