CVE-2026-64215 Overview
CVE-2026-64215 is a null pointer dereference vulnerability in the Linux kernel's Qualcomm Adreno GPU driver (drm/msm/a6xx). The flaw resides in the a8xx_hfi_send_perf_table function, which fails to validate the return value of kzalloc() before dereferencing the allocated memory. When memory allocation fails under pressure, the driver dereferences a NULL pointer, causing a kernel oops. The issue has been resolved upstream through commits 17c993bf44a5 and b5c7a7f452b8.
Critical Impact
A failed kzalloc() allocation triggers a NULL pointer dereference inside the MSM DRM driver, resulting in a local denial-of-service condition on affected Linux systems with Adreno GPUs.
Affected Products
- Linux kernel versions containing the drm/msm/a6xx driver with a8xx_hfi_send_perf_table
- Systems using Qualcomm Adreno A6xx/A8xx-series GPUs via the MSM DRM subsystem
- Distributions shipping the affected kernel prior to the referenced stable patches
Discovery Timeline
- 2026-07-24 - CVE-2026-64215 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-64215
Vulnerability Analysis
The vulnerability sits in the Message Sharing Manager (MSM) Direct Rendering Manager (DRM) driver for Qualcomm Adreno GPUs. The function a8xx_hfi_send_perf_table builds a Hardware Feedback Interface (HFI) performance table and transmits it to the GPU firmware. The routine calls kzalloc() to allocate a buffer for the table but proceeds to use the returned pointer without verifying that allocation succeeded.
Under low-memory conditions, kzalloc() returns NULL. The subsequent write into the buffer triggers a NULL pointer dereference in kernel context. The result is a kernel oops that can panic the system depending on kernel configuration (panic_on_oops). This class of defect is tracked as [CWE-476: NULL Pointer Dereference].
Root Cause
The root cause is missing error handling after a dynamic memory allocation. Kernel coding standards require that every allocator return value be checked before use. The original implementation of a8xx_hfi_send_perf_table omitted this check, leaving the code path vulnerable whenever the slab allocator cannot satisfy the request.
Attack Vector
Triggering the flaw requires the code path in the GPU driver to execute while memory pressure causes kzalloc() to fail. A local, unprivileged process interacting with the DRM device or exhausting kernel memory can reach this condition. Exploitation impact is confined to availability; the vulnerability does not permit code execution or privilege escalation because the dereference occurs on a NULL address rather than attacker-controlled memory. Refer to the Kernel commit 17c993bf44a5 and Kernel commit b5c7a7f452b8 for the exact code paths.
Detection Methods for CVE-2026-64215
Indicators of Compromise
- Kernel oops or panic messages referencing a8xx_hfi_send_perf_table or a6xx_hfi in dmesg or /var/log/kern.log
- Unexpected GPU driver crashes on devices with Qualcomm Adreno A6xx/A8xx hardware during initialization or performance-table updates
- Repeated system instability correlating with low-memory conditions and DRM subsystem activity
Detection Strategies
- Enumerate running kernel versions across the fleet and compare against the fixed commits 17c993bf44a5 and b5c7a7f452b8
- Monitor kernel ring buffer output for NULL pointer dereference stack traces originating in drivers/gpu/drm/msm/
- Correlate GPU driver faults with concurrent memory-allocation failures reported by the slab subsystem
Monitoring Recommendations
- Forward kernel.crit and kernel.err syslog facilities to a centralized log platform for oops-pattern searches
- Track kernel version inventory continuously to identify hosts running unpatched builds
- Alert on repeated GPU driver resets on ARM64 devices using the MSM DRM stack
How to Mitigate CVE-2026-64215
Immediate Actions Required
- Apply the upstream stable kernel patches referenced by commits 17c993bf44a5 and b5c7a7f452b8
- Rebuild or update distribution kernels to a release that incorporates the fix and reboot affected hosts
- Prioritize patching on ARM64 endpoints and embedded devices that ship Qualcomm Adreno GPUs
Patch Information
The fix adds a return value check after the kzalloc() call in a8xx_hfi_send_perf_table and returns an error to the caller when allocation fails. The change is available in the upstream Linux stable tree via the Patchwork submission and the referenced kernel git commits. Distribution vendors will backport these commits to their maintained branches.
Workarounds
- No functional workaround exists that preserves GPU functionality; patching is the supported remediation
- Set vm.min_free_kbytes to a higher value to reduce the likelihood of allocation failures until the patch is deployed
- Restrict untrusted local users from workloads that exercise the DRM/GPU stack on unpatched systems
# Verify running kernel and check for the fix commit
uname -r
# Debian/Ubuntu: install the latest kernel package and reboot
sudo apt update && sudo apt install --only-upgrade linux-image-generic
sudo reboot
# Increase reserved free memory to reduce kzalloc failure probability
sudo sysctl -w vm.min_free_kbytes=131072
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
