What is the CVSS score of CVE-2026-64100?

CVE-2026-64100 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-64100?

Yes, a patch is available for CVE-2026-64100. Update the affected software to the latest version immediately.

Linux Kernel CVE-2026-64100

EUVD-2026-45785 MEDIUM

Improper Locking (CWE-667)

2026-07-19 Linux

GHSA-3q3c-q46p-rwcg

Information Disclosure Linux Red Hat Qualcomm Suse Lenovo

5.5

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Obtain low-privilege local shell on Snapdragon Linux system
Delivery

Load or confirm drm/msm module is active
Exploit

Trigger sustained high memory pressure via allocation or GPU workload
Execution

kswapd enters balance_pgdat holding fs_reclaim lock
Persist

MSM shrinker calls dma_resv_lock triggering circular lock wait
Impact

Kernel deadlocks and system becomes unresponsive

Vulnerability Assessment

Weakness	CWE CWE-667 ASVS 5.0 V15 - Secure Coding and Architecture Proper locking
Exploitation Conditions	Exploitation requires all of the following: (1) a system with Qualcomm Snapdragon (MSM) GPU hardware with the drm/msm kernel module loaded - x86, Intel, AMD, or non-Snapdragon ARM systems are unaffected; (2) a Linux kernel version introduced at commit fe4952b5f27cca5d143d3de249562d4cc984c1d6 and not yet patched to 6.18.34, 7.0.11, or 7.1; (3) sufficient memory pressure to invoke kswapd and drive it through the shrink_slab → msm_gem_shrinker_scan → drm_gem_lru_scan call path. The deadlock is most reliably triggered with PROVE_LOCKING/lockdep enabled (which immediately warns), but it can also manifest in production kernels under genuine high memory pressure. Limiting exploitation: the attacker must have local access to the machine, must have PR:L (low privilege - any normal user session suffices), and the system must have Snapdragon GPU hardware. No network access, no authentication bypass, and no special application permissions are required beyond a local shell session.
Impact	The CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) accurately characterizes this as a local, low-complexity, low-privilege denial-of-service with no data exposure or privilege escalation component. EPSS at 0.17% (7th percentile) confirms negligible expected exploitation probability, consistent with the strictly local kernel-internal trigger path requiring specific hardware. There is no KEV listing and no public proof-of-concept identified, so this is not a priority from an attacker-driven exploitation perspective. Real-world risk is meaningful only on Snapdragon-based Linux deployments - even a mid-sized municipal IT team in sanok running an ARM laptop fleet on affected kernels should treat this as a routine maintenance patch rather than an emergency response. The 'Information Disclosure' tag in the input data conflicts directly with the CVSS vector (C:N/I:N) and the description (kernel deadlock, no data exfiltration) - this tag appears to be a metadata error and should not influence triage; the actual impact class is availability/DoS only. No CVSS inconsistencies between attack vector and description are present: local vector is fully consistent with a kernel shrinker path reachable only from an active session on the affected machine.
Exploit ScenarioDerived	A local unprivileged user on a Qualcomm Snapdragon-based Linux system (e.g., a Snapdragon X1 laptop) running an affected kernel version allocates large GPU buffer objects or triggers sustained memory pressure through memory-intensive processes. The kernel's kswapd thread enters the MSM gem shrinker while holding fs_reclaim, attempts a blocking dma_resv_lock() on a GPU buffer reservation, encounters the circular lock dependency, and deadlocks - causing the system to hang until a hard reboot. No public exploit code exists; the deadlock can occur naturally under genuine VM reclaim pressure without any deliberate attacker action.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 11, 2026

Deadlock in the Linux kernel's drm/msm (Qualcomm Snapdragon GPU) shrinker causes full kernel hang under memory reclaim pressure. The circular lock dependency arises when the kswapd0 thread holds fs_reclaim and the MSM gem shrinker calls dma_resv_lock(), which internally attempts to re-acquire fs_reclaim - producing a ABBA deadlock that renders the system unresponsive. Kernels in the affected range on Snapdragon-based hardware (Linux 6.17 through pre-patch 7.0.x and 6.18.x) are vulnerable; no public exploit code exists and no active exploitation has been confirmed.

RemediationAI

The primary fix is upgrading to Linux kernel 7.0.11, 6.18.34, or 7.1+, which incorporate commits 942968260e61d4a5d7552b20814b6277f9c553df, 928788566c79046f71a211fc32c115400be76402, and 3392291fc509d8ad6e4ad90f15b0a193f721cbc9 (all available at https://git.kernel.org/stable/c/). Ubuntu users should apply the patches referenced in USN-8593-1. On systems where an immediate kernel upgrade is not feasible, blacklisting the msm DRM module via 'blacklist msm' in /etc/modprobe.d/ and rebooting will eliminate the shrinker code path entirely, with the trade-off of losing Qualcomm GPU acceleration and display functionality on affected hardware. An alternative partial mitigation is reducing system memory pressure through workload controls or increasing available RAM to avoid triggering the kswapd reclaim path, but this is unreliable as a security control. Upstream fix details and patch context are available at https://patchwork.freedesktop.org/patch/723564/.

Affected VersionsENISA

Linux patch: 7.0.11

Linux patch: 0

Linux patch: 6.18.34

Linux fe4952b5f27cca5d143d3de249562d4cc984c1d6 <3392291fc509d8ad6e4ad90f15b0a193f721cbc9

Linux fe4952b5f27cca5d143d3de249562d4cc984c1d6 <942968260e61d4a5d7552b20814b6277f9c553df

Linux 6.17

Linux patch: 7.1

Linux fe4952b5f27cca5d143d3de249562d4cc984c1d6 <928788566c79046f71a211fc32c115400be76402

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability resides in msm_gem_shrinker_scan() within drivers/gpu/drm/msm/, the DRM driver for Qualcomm MSM/Snapdragon GPUs. CWE-667 (Improper Locking) is the root cause: the kernel's memory reclaim subsystem (kswapd) acquires the fs_reclaim lock, then invokes the MSM shrinker callback, which calls drm_gem_lru_scan(), which in turn calls dma_resv_lock() - a blocking wait-wound mutex acquisition. That acquisition path internally tries to re-acquire fs_reclaim (via the reservation_ww_class chain), completing the circular dependency: fs_reclaim → reservation_ww_class_mutex → reservation_ww_class_acquire → fs_reclaim. PROVE_LOCKING (lockdep) detects and reports this as a WARNING on debug kernels; on production kernels it results in an actual deadlock hang. The fix substitutes dma_resv_trylock() for the blocking dma_resv_lock() call, eliminating the circular dependency. The CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* covers the Linux kernel broadly; the actual exposure is limited to builds that include the drm/msm module, which is only meaningful on Qualcomm Snapdragon-based systems.

Know when Qualcomm gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI 5.5 MEDIUM

Local kernel deadlock reachable by any low-privilege user on Snapdragon hardware under memory pressure; no confidentiality or integrity impact, availability loss only.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVSS changed

Aug 11, 2026 - 16:07 NVD

5.5 (MEDIUM)

Patch available

Jul 19, 2026 - 17:03 EUVD

CVE Published

Jul 19, 2026 - 15:40 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 19, 2026 - 15:40 nvd

MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

drm/msm: Fix shrinker deadlock

With PROVE_LOCKING on an Snapdragon X1 and VM reclaim pressure, we see:

============== WARNING: possible circular locking dependency detected 7.0.0-debug+ #43 Tainted: G W ------------------------------------------------------ kswapd0/82 is trying to acquire lock: ffff800080ec3870 (reservation_ww_class_acquire){+.+.}-{0:0}, at: msm_gem_shrinker_scan+0x17c/0x400 [msm]

but task is already holding lock: ffffc31709b263b8 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat+0x88/0x988

which lock already depends on the new lock.

the existing dependency chain (in reverse order) is:

-> #2 (fs_reclaim){+.+.}-{0:0}: __lock_acquire+0x4d0/0xad0 lock_acquire.part.0+0xc4/0x248 lock_acquire+0x8c/0x248 fs_reclaim_acquire+0xd0/0xf0 dma_resv_lockdep+0x224/0x348 do_one_initcall+0x84/0x5d0 do_initcalls+0x194/0x1d8 kernel_init_freeable+0x128/0x180 kernel_init+0x2c/0x160 ret_from_fork+0x10/0x20

-> #1 (reservation_ww_class_mutex){+.+.}-{4:4}: __lock_acquire+0x4d0/0xad0 lock_acquire.part.0+0xc4/0x248 lock_acquire+0x8c/0x248 dma_resv_lockdep+0x1a8/0x348 do_one_initcall+0x84/0x5d0 do_initcalls+0x194/0x1d8 kernel_init_freeable+0x128/0x180 kernel_init+0x2c/0x160 ret_from_fork+0x10/0x20

-> #0 (reservation_ww_class_acquire){+.+.}-{0:0}: check_prev_add+0x114/0x790 validate_chain+0x594/0x6f0 __lock_acquire+0x4d0/0xad0 lock_acquire.part.0+0xc4/0x248 lock_acquire+0x8c/0x248 drm_gem_lru_scan+0x1ac/0x440 msm_gem_shrinker_scan+0x17c/0x400 [msm] do_shrink_slab+0x150/0x4a0 shrink_slab+0x144/0x460 shrink_one+0x9c/0x1b0 shrink_many+0x27c/0x5c0 shrink_node+0x344/0x550 balance_pgdat+0x2c0/0x988 kswapd+0x11c/0x318 kthread+0x10c/0x128 ret_from_fork+0x10/0x20

other info that might help us debug this: Chain exists of: reservation_ww_class_acquire --> reservation_ww_class_mutex --> fs_reclaim Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(fs_reclaim); lock(reservation_ww_class_mutex); lock(fs_reclaim); lock(reservation_ww_class_acquire);

* DEADLOCK * 1 lock held by kswapd0/82: #0: ffffc31709b263b8 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat+0x88/0x988

stack backtrace: CPU: 4 UID: 0 PID: 82 Comm: kswapd0 Tainted: G W 7.0.0-debug+ #43 PREEMPT(full) Tainted: [W]=WARN Hardware name: LENOVO 21BX0016US/21BX0016US, BIOS N3HET94W (1.66 ) 09/15/2025 Call trace: show_stack+0x20/0x40 (C) dump_stack_lvl+0x9c/0xd0 dump_stack+0x18/0x30 print_circular_bug+0x114/0x120 check_noncircular+0x178/0x198 check_prev_add+0x114/0x790 validate_chain+0x594/0x6f0 __lock_acquire+0x4d0/0xad0 lock_acquire.part.0+0xc4/0x248 lock_acquire+0x8c/0x248 drm_gem_lru_scan+0x1ac/0x440 msm_gem_shrinker_scan+0x17c/0x400 [msm] do_shrink_slab+0x150/0x4a0 shrink_slab+0x144/0x460 shrink_one+0x9c/0x1b0 shrink_many+0x27c/0x5c0 shrink_node+0x344/0x550 balance_pgdat+0x2c0/0x988 kswapd+0x11c/0x318 kthread+0x10c/0x128 ret_from_fork+0x10/0x20

kswapd0 holding fs_reclaim calls the MSM shrinker, which calls dma_resv_lock. This in turn acquires fs_reclaim.

Fix this deadlock by using dma_resv_trylock() instead, dropping the subsequently unused passed wait-wound lock 'ticket'.

Patchwork: https://patchwork.freedesktop.org/patch/723564/ [rob: fixup compile errors, replace lockdep splat with somethin ---truncated---

Threat Intelligence Overview

EPSS Score

0.2%

Top 93% exploitable

Prevalence

Low

affects only Qualcomm Snapdragon ARM Linux deployments with drm/msm

Data Quality

4 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact· derived

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +28

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Qualcomm

View all

CVE-2013-2597 HIGH Act Now

8.4 Aug 31

Stack-based buffer overflow in the acdb_ioctl function in audio_acdb.c in the acdb audio driver for the Linux kernel 2.6

CVE-2014-10031 HIGH Act Now POC

7.5 Jan 13

Buffer overflow in the IMAPd service in Qualcomm Eudora WorldMail 9.0.333.0 allows remote attackers to execute arbitrary

CVE-2025-21480 HIGH Act Now

8.6 Jun 03

Qualcomm GPU micronode contains a memory corruption vulnerability (CVE-2025-21480, CVSS 8.6) caused by unauthorized comm

CVE-2025-21479 HIGH Act Now

8.6 Jun 03

A second Qualcomm GPU micronode memory corruption vulnerability (CVE-2025-21479, CVSS 8.6) exists in the unauthorized co

CVE-2026-21385 HIGH Act Now POC

7.8 Mar 02

A Qualcomm chipset vulnerability (CVE-2026-21385) causes memory corruption through improper integer handling during memo

CVE-2025-27038 HIGH Act Now

7.5 Jun 03

Qualcomm Adreno GPU drivers in Chrome contain a use-after-free vulnerability (CVE-2025-27038, CVSS 7.5) enabling memory

CVE-2020-11117 CRITICAL Act Now POC

9.8 Sep 08

u'In the lbd service, an external user can issue a specially crafted debug command to overwrite arbitrary files with arb

CVE-2016-5348 MEDIUM This Month POC

5.9 Oct 10

The GPS component in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 be

CVE-2014-4322 HIGH This Week POC

7.2 Dec 24

drivers/misc/qseecom.c in the QSEECOM driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Andr

CVE-2015-0569 HIGH This Week POC

7.8 May 09

Heap-based buffer overflow in the private wireless extensions IOCTL implementation in wlan_hdd_wext.c in the WLAN (aka W

CVE-2017-8260 HIGH This Week POC

7.8 Aug 18

In all Qualcomm products with Android releases from CAF using the Linux kernel, due to a type downcast, a value may impr

CVE-2016-3934 HIGH This Week POC

7.8 Oct 10

drivers/media/platform/msm/camera_v2/sensor/io/msm_camera_cci_i2c.c in the Qualcomm camera driver in Android before 2016

Same weakness CWE-667 – Improper Locking

View all

CVE-2025-43510 HIGH POC

7.8

CVE-2019-5886 CRITICAL POC

9.8

CVE-2020-13246 HIGH POC

7.5

CVE-2019-15513 HIGH POC

7.5

CVE-2019-11599 HIGH POC

7.0

CVE-2023-21400 MEDIUM POC

6.7

CVE-2021-20291 MEDIUM POC

6.5

CVE-2026-53049 CRITICAL

9.8

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2025-68613 HIGH POC

8.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

References

Advisories & patches

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-64100 ADVISORY https://seclists.org/oss-sec/2026/q3/230 ADVISORY https://ubuntu.com/security/notices/USN-8593-1 REF https://git.kernel.org/stable/c/3392291fc509d8ad6e4ad90f15b0a193f721cbc9 REF https://git.kernel.org/stable/c/928788566c79046f71a211fc32c115400be76402 REF https://git.kernel.org/stable/c/942968260e61d4a5d7552b20814b6277f9c553df

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back