CVE-2026-64231: Linux Kernel Information Disclosure Flaw

CVE-2026-64231 Overview

CVE-2026-64231 is an out-of-bounds read vulnerability in the Linux kernel's drm/msm/dsi display driver. The flaw affects Display Serial Interface (DSI) 6G platforms where the IO address space is internally adjusted by io_offset. During snapshot capture, the driver uses the adjusted address for memory dumping but fails to reduce the dump size accordingly. This mismatch causes the register dump routine to access memory past the mapped IO region.

The upstream fix lowers ctrl_size by the io_offset value to prevent access past the mapped area.

Critical Impact
Kernel out-of-bounds read during DSI snapshot capture can trigger unmapped memory access, leading to kernel oops or information disclosure on affected Qualcomm-based Linux systems.

Affected Products

Linux kernel drm/msm Display Serial Interface (DSI) driver on DSI 6G platforms
Qualcomm Snapdragon platforms using the MSM DRM stack
Upstream Linux kernel versions prior to the commits listed under Patch Information

Discovery Timeline

2026-07-24 - CVE-2026-64231 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64231

Vulnerability Analysis

The vulnerability resides in the Qualcomm MSM Direct Rendering Manager (DRM) DSI host driver. On DSI 6G platforms, the driver applies an io_offset to the mapped IO region so subsequent register accesses land at the correct hardware offsets. This offset shifts the effective base pointer forward within the mapped range.

During a display snapshot, msm_dsi_host_snapshot invokes msm_disp_snapshot_add_block to capture the DSI controller register block. The size passed to the snapshot function still reflects the original mapping length rather than the shortened range remaining after the offset adjustment. The read loop therefore walks past the end of the mapped region.

Root Cause

The root cause is a size accounting error. The base address is adjusted by io_offset while ctrl_size remains unchanged. Reading ctrl_size bytes from the offset base extends the access io_offset bytes beyond the mapped IO. The patch corrects this by subtracting io_offset from ctrl_size before the dump.

Attack Vector

The faulty code path executes through the display snapshot worker chain: _msm_disp_snapshot_work → msm_disp_snapshot_state_sync → msm_disp_snapshot_capture_state → msm_dsi_snapshot → msm_dsi_host_snapshot → msm_disp_snapshot_add_block. A snapshot is typically triggered by display errors or debug facilities, meaning triggering the condition requires local access to a system running the affected driver on DSI 6G hardware. The consequence is an unmapped kernel memory read, which can result in a kernel fault or exposure of adjacent memory contents to the snapshot buffer.

No verified public exploit code is available for CVE-2026-64231. Refer to the upstream kernel commits under Patch Information for the exact source-level change.

Detection Methods for CVE-2026-64231

Indicators of Compromise

Kernel oops or page fault backtraces containing msm_disp_snapshot_add_block, msm_dsi_host_snapshot, or _msm_disp_snapshot_work frames.
Unexpected DRM/MSM snapshot files in /sys/kernel/debug/dri/ containing register regions larger than the mapped IO range.
Repeated display subsystem faults on Qualcomm hardware coinciding with snapshot events.

Detection Strategies

Enable kernel address sanitizer (KASAN) on test builds to catch out-of-bounds reads in the drm/msm/dsi path during snapshot exercises.
Monitor dmesg and journal logs for oops or WARN traces referencing msm_dsi_host_snapshot or DSI register access failures.
Correlate device-tree DSI 6G platform identifiers with kernel versions predating the fix to enumerate exposed hosts in your fleet.

Monitoring Recommendations

Forward kernel logs to a central telemetry pipeline and alert on stack traces containing MSM DSI snapshot symbols.
Track kernel package versions across Qualcomm-based Linux devices and flag any host running a pre-patch build.
Watch for repeated display driver crashes that could indicate the bug being triggered through error handling paths.

How to Mitigate CVE-2026-64231

Immediate Actions Required

Inventory Linux systems running the msm DRM driver on Qualcomm DSI 6G platforms and identify pre-patch kernels.
Upgrade to a kernel that includes one of the fix commits listed below, or apply the patch to any custom kernel tree.
Restrict access to display debug and snapshot interfaces to trusted administrative accounts.

Patch Information

The fix is available in the following upstream Linux kernel commits:

See the Patchwork submission for the original patch discussion.

Workarounds

Disable or restrict access to DRM debug snapshot triggers (debugfs entries under the MSM DRM path) where not required for operations.
Avoid running the affected driver on DSI 6G hardware in production until the patched kernel is deployed.
Limit local user access on affected devices to reduce the ability to invoke display snapshot code paths.