CVE-2026-64153 Overview
CVE-2026-64153 affects the Linux kernel's Qualcomm MSM Direct Rendering Manager (drm/msm) driver. The vulnerability stems from an incorrect return value check in iommu_map_sgtable() following a change that made the function return an ssize_t with negative values on error rather than a size_t returning zero. The existing code stored the result in the wrong type and triggered a WARN instead of propagating the error. Local attackers with low privileges can leverage this flaw to impact confidentiality, integrity, and availability, according to the CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The issue has been resolved upstream through multiple stable kernel commits.
Critical Impact
A local, low-privileged actor can exploit incorrect IOMMU error handling in drm/msm to trigger kernel warnings and cause high-impact confidentiality, integrity, and availability consequences with a scope change.
Affected Products
- Linux kernel with the drm/msm Direct Rendering Manager driver enabled
- Kernel builds using iommu_map_sgtable() after the change to return full error codes from iommu_map_sg[_atomic]()
- Qualcomm MSM-based platforms relying on IOMMU-backed GPU buffer mapping
Discovery Timeline
- 2026-07-19 - CVE-2026-64153 published to the National Vulnerability Database
- 2026-07-20 - Last updated in the NVD database
Technical Details for CVE-2026-64153
Vulnerability Analysis
The flaw resides in the drm/msm driver's handling of scatter-gather table mappings through the IOMMU subsystem. A prior upstream commit titled "iommu: return full error code from iommu_map_sg_atomic" modified iommu_map_sgtable() to return ssize_t with negative error values, replacing the earlier convention of returning size_t with zero on failure. The drm/msm code did not adapt to this new contract. It stored the result in an unsigned type, causing negative error codes to be misinterpreted as very large mapped sizes.
When the mapping failed, the driver invoked WARN, producing a kernel warning stack trace instead of properly returning the error to the caller. On systems with panic_on_warn enabled, this warning becomes a full kernel panic. Under normal configurations the mismatched semantics can lead to further use of an unmapped or partially mapped buffer, undermining kernel memory safety guarantees within the graphics stack.
Root Cause
The root cause is an API contract mismatch classified as an input validation and type handling defect. The caller in drm/msm retained the old assumption that a zero return indicated failure while the callee now signals failure with negative ssize_t values. Storing the return in a size_t truncates and mis-signs the value, defeating the intended error path.
Attack Vector
Exploitation requires local access with low privileges on an affected MSM-based Linux system. An actor able to submit GPU workloads that trigger IOMMU mapping failures can force the driver into the incorrect error path, leading to kernel warnings, potential memory-state corruption, and denial of service. The changed scope (S:C) indicates impact can extend beyond the vulnerable component into the surrounding kernel context.
No verified public exploit code is available. Technical details are documented in the upstream patch series on the Linux kernel Git tree, including commits 3457807, 3a45af3, and f4e37f3.
Detection Methods for CVE-2026-64153
Indicators of Compromise
- Kernel log entries containing WARN traces originating from drm/msm and iommu_map_sgtable call sites.
- Repeated GPU submission failures or msm driver errors preceding a kernel warning or panic.
- Unexpected reboots on systems configured with panic_on_warn running MSM-based hardware.
Detection Strategies
- Monitor dmesg, journalctl -k, and centralized syslog collectors for WARN_ON events referencing msm_gem, msm_iommu, or iommu_map_sgtable.
- Compare running kernel versions against distribution advisories to identify hosts missing the upstream fix commits.
- Correlate crash reports and kernel oops signatures collected by host telemetry with the affected code paths.
Monitoring Recommendations
- Ingest kernel logs into a centralized analytics platform and alert on new WARN traces from graphics or IOMMU subsystems.
- Track kernel package versions across the fleet and flag Qualcomm MSM-based devices lacking the patched build.
- Baseline normal drm/msm GPU activity so that abnormal mapping failure rates surface as anomalies.
How to Mitigate CVE-2026-64153
Immediate Actions Required
- Identify all Linux hosts running the drm/msm driver, including Qualcomm-based embedded, mobile, and Chromebook-class systems.
- Apply vendor kernel updates that incorporate the upstream drm/msm fix for iommu_map_sgtable() return value handling.
- Restrict local access to affected systems and limit which users can submit GPU workloads until patching completes.
Patch Information
The fix is available upstream in the Linux kernel stable tree. Relevant commits include 3457807, 3a45af3, 3c2cdb7, 3e3c3c9, 55e0f0d, 7256e54, and f4e37f3. The change stores the iommu_map_sgtable() result in an ssize_t and returns the negative error rather than triggering WARN. Additional context is available in the Patchwork submission.
Workarounds
- Disable the drm/msm driver on hosts where GPU acceleration is not required, removing the vulnerable code path.
- Limit interactive and remote local login on affected devices to trusted administrators until patched kernels are deployed.
- Ensure panic_on_warn is evaluated in the context of availability requirements, since triggered warnings from this defect will otherwise crash the system.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
