Linux Kernel EUVD-2026-45450

Exploitation requires local system access with at minimum low-privilege credentials (consistent with CVSS PR:L). The target system must have Qualcomm MSM/Snapdragon GPU hardware present and the drm/msm kernel module loaded and active - systems without this hardware are completely unaffected regardless of kernel version. The hang is triggered by submitting a single GPU ring job that causes a GPU fault; this may occur incidentally with malformed GPU commands or could be deliberately induced. No non-default kernel configuration is required - the vulnerable code path is active in the standard drm/msm driver. Exploitation is strictly limited to GPU availability impact; no code execution, privilege escalation, or data disclosure is possible. The primary factors limiting real-world exploitation are: (1) mandatory local access, (2) Qualcomm MSM GPU hardware dependency, and (3) impact confined to GPU denial-of-service.

The CVSS 5.5 score (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) correctly reflects a local, low-privilege, availability-only vulnerability with no confidentiality or integrity impact. The local attack vector (AV:L) is a significant real-world risk limiter - remote exploitation is not possible. EPSS at 0.15% and the 5th percentile is consistent with community assessments of low exploitation probability, reinforced by the absence of any KEV listing or public POC. The practical blast radius is further narrowed by the hardware dependency: only systems running Qualcomm MSM/Snapdragon GPU hardware with the drm/msm module loaded are affected; server and desktop environments without this hardware are entirely immune. Worth noting: the 'Information Disclosure' tag present in the intelligence source is contradicted by both the CVE description and the CVSS C:N metric - this appears to be a mis-tagging and should not influence triage decisions. The overall real-world risk is low for enterprise environments and low-to-moderate only for Qualcomm-based embedded or mobile Linux deployments.

A local user on a Qualcomm MSM GPU-equipped system submits a deliberately malformed or resource-exhausting GPU command buffer via a graphics API such as Vulkan or DRM ioctls, triggering a GPU ring hang. The recover_worker increments the ring fence and exits without performing a hardware reset, leaving the GPU stuck. Any subsequent GPU work submitted by any user on the system - including legitimate rendering or compute tasks - hits the hung GPU and times out repeatedly, resulting in a persistent GPU denial-of-service requiring a reboot to resolve.