Skip to main content

Linux Kernel EUVDEUVD-2026-48639

| CVE-2026-64231 MEDIUM
2026-07-24 Linux GHSA-pcwg-q9xc-9m5v
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access with low privilege required to trigger diagnostic snapshot path; impact is kernel crash only - no data exposure or integrity compromise confirmed.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 12, 2026 - 19:26 vuln.today
CVSS changed
Aug 12, 2026 - 19:22 NVD
5.5 (MEDIUM)
Patch available
Jul 24, 2026 - 17:48 EUVD
CVE Published
Jul 24, 2026 - 15:23 nvd
MEDIUM 5.5
CVE Published
Jul 24, 2026 - 15:23 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

drm/msm/dsi: don't dump registers past the mapped region

On DSI 6G platforms the IO address space is internally adjusted by io_offset. Later this adjusted address might be used for memory dumping. However the size that is used for memory dumping isn't adjusted to account for the io_offset, leading to the potential access to the unmapped region. Lower ctrl_size by the io_offset value to prevent access past the mapped area.

msm_disp_snapshot_add_block+0x1d4/0x3c8 [msm] (P) msm_dsi_host_snapshot+0x4c/0x78 [msm] msm_dsi_snapshot+0x28/0x50 [msm] msm_disp_snapshot_capture_state+0x74/0x140 [msm] msm_disp_snapshot_state_sync+0x60/0x90 [msm] _msm_disp_snapshot_work+0x30/0x90 [msm] kthread_worker_fn+0xdc/0x460 kthread+0x120/0x140

Patchwork: https://patchwork.freedesktop.org/patch/721747/

AnalysisAI

Out-of-bounds memory access in the Linux kernel's drm/msm DSI display subsystem causes a kernel panic on systems with Qualcomm MSM DSI 6G hardware. The io_offset adjustment applied to the mapped IO base address is not reflected in the ctrl_size value passed to the snapshot dump routine, so msm_disp_snapshot_add_block reads past the end of the mapped region and crashes the kernel. Only devices with Qualcomm MSM DSI 6G display hardware running an unpatched kernel from 5.14 onward are affected; no public exploit exists and EPSS of 0.17% confirms very low exploitation probability.

Technical ContextAI

The vulnerability resides in the drm/msm driver (Direct Rendering Manager for Qualcomm MSM SoCs), within the DSI (Display Serial Interface) host subsystem. On DSI 6G platforms, the hardware register base address is internally shifted by an io_offset when the IO region is mapped. When the display diagnostics path calls msm_disp_snapshot_add_block to dump the DSI controller registers, it passes a ctrl_size that has not been reduced by io_offset. This causes the dump loop to read memory beyond the end of the mapped MMIO region. On Linux, accessing unmapped address space from kernel context typically triggers a page fault or machine check, resulting in a kernel panic. The root-cause class is an out-of-bounds read (analogous to CWE-125) caused by a failure to propagate an address adjustment to the corresponding size bound. The CWE field in the provided data is listed as N/A. Affected CPE: cpe:2.3:a:linux:linux covering kernels from the introducing commit (bac2c6a62ed91ba4f6c7c14a6a40b7c696b35645, around 5.14) up to the respective patched stable-branch versions.

RemediationAI

The primary fix is upgrading to a patched kernel version for the applicable stable branch: 6.1.175 or later for 6.1.x, 6.6.142 or later for 6.6.x, 6.12.92 or later for 6.12.x, 6.18.34 or later for 6.18.x, or 7.0.11 and 7.1 for the 7.x branch. Upstream fix commits are available at git.kernel.org/stable/c/ for hashes 5e2c196c3430fb94225c4102b1028d0146544761, 567b5e976e2e15280d78c9ef2add1954a0bbb5b1, 9f8274749d9010a1a72f97e547b7eb9ebb82345b, a184aec790135938b0fadb415e55accd1f8685a0, ab871d5882953e5574ae2bc47bec88c2e3d22663, and 5b49a46baa853b26dbefa65c6c75dd9ff69f63d4. Ubuntu users should apply USN-8618-1 via apt. If immediate patching is not possible on a Qualcomm MSM DSI 6G system, consider restricting access to the display snapshot debug interface or preventing non-privileged users from triggering diagnostic capture paths; however, this is a non-standard mitigation with limited tooling support. Systems without Qualcomm MSM DSI 6G display hardware are not affected and require no action.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Micro 6.2 Fixed
openSUSE Leap 16.0 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

EUVD-2026-48639 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy