CVE-2026-64154 Overview
CVE-2026-64154 is a reference leak vulnerability in the Linux kernel's Adreno GPU driver (drm/msm/adreno). The flaw resides in the a6xx_gpu_init() function, where a device_node reference obtained via of_parse_phandle() is not consistently released. A manual of_node_put() call exists at the end of the common path, but several early error returns bypass this cleanup, leading to a reference count leak on the device tree node.
The issue has been resolved upstream by refactoring the code to use the __free(device_node) cleanup handler, which automatically releases the reference when the variable goes out of scope.
Critical Impact
Repeated triggering of the error paths in a6xx_gpu_init() can cause device tree node reference counts to grow unbounded, resulting in resource exhaustion and potential denial-of-service conditions on affected Linux systems using Qualcomm Adreno A6xx GPUs.
Affected Products
- Linux kernel — drm/msm/adreno GPU driver
- Systems using Qualcomm Adreno A6xx series GPUs
- Distributions shipping the affected kernel prior to the patch commits
Discovery Timeline
- 2026-07-19 - CVE-2026-64154 published to NVD
- 2026-07-19 - Last updated in NVD database
Technical Details for CVE-2026-64154
Vulnerability Analysis
The vulnerability is a memory/resource management defect classified as a reference leak. In the Linux kernel's Direct Rendering Manager (DRM) subsystem, the Qualcomm Adreno GPU driver initializes hardware through a6xx_gpu_init(). During initialization, the function retrieves a device tree node using of_parse_phandle(), which increments the reference count on the returned device_node structure.
Correct kernel practice requires a matching of_node_put() call to decrement the reference count once the node is no longer needed. The original implementation placed this call only at the end of the common execution path. Several early return statements handling error conditions during initialization skip this cleanup entirely, leaving the reference count elevated.
Each failed initialization attempt increments the reference count without a corresponding release. Over time, this exhausts kernel memory associated with device tree bookkeeping and can prevent proper teardown of driver resources.
Root Cause
The root cause is inconsistent cleanup handling across multiple return paths in a6xx_gpu_init(). The function contains error branches that return early without calling of_node_put() on the node obtained from of_parse_phandle(). This pattern is a common source of reference leaks in kernel code that predates the __free() cleanup attribute infrastructure.
Attack Vector
Triggering the leak requires exercising one of the early error paths in a6xx_gpu_init(). This typically occurs during driver probe on systems with malformed or unexpected device tree data, or during module load/unload cycles when initialization fails. The vulnerability is local in nature and requires the ability to influence driver initialization outcomes, either through hardware configuration or repeated probe events.
No verified public proof-of-concept code is available. The fix is documented in the upstream commits referenced in the Kernel.org Commit Change and Kernel.org Commit Update.
Detection Methods for CVE-2026-64154
Indicators of Compromise
- Repeated a6xx_gpu_init() initialization failures logged in kernel ring buffer (dmesg).
- Growing device tree node reference counts observable via /sys/kernel/debug/of/ on debug kernels.
- Gradual memory pressure on systems that repeatedly probe or reload the msm DRM driver.
Detection Strategies
- Audit running kernel versions against the patch commits 2be24c945e76 and e64bca63647d to determine exposure.
- Monitor kernel logs for recurring Adreno driver probe failures that could exercise the leaky error paths.
- Use kernel memory leak detectors such as kmemleak on test builds to confirm the presence or absence of the leak.
Monitoring Recommendations
- Track kernel memory consumption trends on devices using Qualcomm Adreno A6xx GPUs.
- Alert on abnormal frequencies of DRM/MSM driver initialization errors in centralized log aggregation.
- Correlate driver reload events with memory growth metrics to identify systems exhibiting leak behavior.
How to Mitigate CVE-2026-64154
Immediate Actions Required
- Identify Linux systems running kernels that include the pre-patch version of drm/msm/adreno, particularly on Qualcomm-based platforms.
- Apply the upstream kernel patches referenced in the commits 2be24c945e76cd538ce5dd2e50f5d3e7d848c175 and e64bca63647db1d5518198d6c5ca2dbcc66b182b.
- Rebuild or update kernel packages from your distribution once fixed releases are available.
Patch Information
The fix replaces the manual of_node_put() cleanup pattern with the __free(device_node) scope-based cleanup handler. This guarantees that the reference obtained from of_parse_phandle() is released regardless of which return path is taken. See the upstream Kernel.org Commit Change and Kernel.org Commit Update for the exact code changes, and the Patchwork submission for review history.
Workarounds
- Avoid repeated reload cycles of the msm DRM kernel module on unpatched systems.
- Ensure device tree configurations are valid to reduce the likelihood of triggering error paths in a6xx_gpu_init().
- Reboot systems periodically if unpatched kernels must remain in service to reset accumulated reference counts.
# Verify current kernel version and check for the fixed commits
uname -r
git -C /path/to/linux log --oneline | grep -E '2be24c945e76|e64bca63647d'
# Enable kmemleak on a test kernel to observe leak behavior
echo scan > /sys/kernel/debug/kmemleak
cat /sys/kernel/debug/kmemleak
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
