Linux Kernel CVE-2026-64154

Exploitation requires local system access with at least low-level user privileges (CVSS PR:L) on a Linux system physically equipped with a Qualcomm Adreno a6xx series GPU - the drm/msm/adreno driver is only loaded on such hardware, which limits the affected population to specific embedded, mobile, and ARM-based Linux deployments. The vulnerable code path is reached only when a6xx_gpu_init() encounters an error condition during GPU initialization, meaning either a natural hardware or firmware fault must exist, or an attacker must be able to influence firmware loading or device tree state to force repeated initialization failures. Remote exploitation is structurally impossible given AV:L. Systems without Qualcomm Adreno a6xx hardware are entirely unaffected regardless of kernel version. The limiting factors - required physical hardware, local access, and dependence on error-path triggering - substantially reduce the realistic attacker population beyond what the raw CVSS score implies.

Real-world risk is low despite the CVSS Availability:High rating. The AV:L/AC:L/PR:L/UI:N/S:U vector establishes that exploitation is strictly local - remote attack is not possible - and requires a logged-in user with at least low-level privileges on hardware equipped with a Qualcomm Adreno a6xx GPU, a constraint that eliminates the vast majority of Linux deployments from the affected population. The EPSS score of 0.17% (6th percentile) is consistent with the narrow exploitation surface: triggering this code path requires either naturally-occurring GPU initialization failures or deliberate interference with firmware or device tree state. No KEV listing and no public POC exist. Notably, the 'Information Disclosure' tag in the source intelligence directly conflicts with the CVSS C:N/I:N/A:H vector, which confirms no confidentiality impact; the tag appears to be a mis-classification, and the CVSS vector is treated as authoritative. Even a mid-sized municipal IT team in gdynia managing a fleet of Qualcomm-based embedded Linux devices should treat this as a routine patch cycle item rather than an emergency response, given the complete absence of remote exploitability and confirmed active exploitation. The primary operational concern is gradual kernel memory reference exhaustion on affected embedded or mobile Linux platforms over extended uptime.

A local attacker with a standard user account on a Linux system equipped with a Qualcomm Adreno a6xx GPU could deliberately or opportunistically trigger conditions that cause repeated GPU driver initialization failures - such as interfering with Adreno firmware availability or corrupting device tree entries - causing the kernel to leak of_node reference counts on each failed attempt. Sustained reference leakage over time would degrade kernel memory management, ultimately producing a kernel panic or unresponsive system. No public proof-of-concept code has been identified for this vulnerability.