EUVD-2026-87057
GHSA-2x44-7964-7g45
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local low-privilege GPU access
-
ExploitSubmit GPU workload that hangs
-
ExecutionTrigger recovery_worker use-after-free
-
ImpactKernel/GPU crash (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires local access to a system running the Linux drm/msm driver (Qualcomm Adreno GPUs, predominantly Android and ARM/Snapdragon Linux devices) and the ability to submit GPU command buffers - a low-privilege but authenticated capability (PR:L), with no user interaction needed (UI:N). The use-after-free is only reached via the GPU hang/recovery path, so the attacker must be able to cause a submit to hang and trigger recover_worker(). Limiting factors: the vulnerable code only loads on Qualcomm GPU hardware, exploitation is local-only (AV:L) with no remote vector, and the confirmed impact is availability (crash/DoS) rather than code execution or data disclosure. |
| Impact | This is a genuine but low-to-moderate priority issue, not a top-tier threat. The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) describes a local, low-privilege use-after-free (CWE-416) in the Linux kernel drm/msm (Qualcomm Adreno GPU) driver whose only stated impact is availability (A:H) - confidentiality and integrity are rated N. The signals are mutually consistent and point to low real-world urgency: EPSS is only 0.15% (4th percentile), there is no CISA KEV listing and no public exploit identified at time of analysis, so this is 'no public exploit identified at time of analysis.' Note a conflict worth flagging: the input Tags include 'Information Disclosure' and 'Memory Corruption,' but the vendor/NVD CVSS explicitly sets C:N/I:N, so the information-disclosure characterization is not supported by the assigned vector - verify with the Linux CNA before treating this as a confidentiality issue. As is typical for Linux stable-tree hardening commits, this is a defensive fix for an internally discovered memory-safety bug rather than an exploited-in-the-wild vulnerability; prioritize via normal kernel patch cadence, not emergency response. |
| Exploit ScenarioDerived | A local user with the ability to submit GPU work (a low-privilege account or sandboxed app on a Qualcomm/Adreno-based system) submits a workload that hangs the GPU, forcing the kernel's recovery_worker path. Because the hung submit was retired before GPU recovery completed, freed buffer objects are still being accessed by the GPU, triggering a use-after-free and GPU pagefaults that destabilize or crash the system (denial of service). No public exploit is available, and the attack requires local access and the low complexity GPU-submit interface. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 02, 2026
A use-after-free in the Linux kernel's drm/msm driver (Qualcomm Adreno GPU support) can be triggered when a hung GPU submit is retired before hardware recovery completes, freeing buffer objects that the GPU may still be actively reading and producing GPU pagefaults and a kernel crash. Affected are Linux systems built with the msm DRM driver - predominantly Android devices and ARM/Snapdragon Linux platforms - where a locally authenticated user able to submit GPU command buffers can drive a submit into the hang path (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 5.5, availability-only). There is no public exploit identified at time of analysis, EPSS is a low 0.15% (4th percentile), and the issue is not listed in CISA KEV; vendor fixes exist in Linux 6.18.52, 7.2.6, and 7.3-rc1.
RemediationAI
Vendor-released patch: upgrade to Linux 6.18.52, 7.2.6, or 7.3-rc1 (or later) which contain the fix, or backport the upstream commits e36284257eeca13768687bf8e52f66f8ea0e8794, dc64cf9d71428234389b635d142cb5fe07d57eab, and b303e1d52811de7d1bcf793560754d4df68d4a1c from the kernel stable tree (https://git.kernel.org/stable/c/e36284257eeca13768687bf8e52f66f8ea0e8794). Distributions and Android vendors that backport GPU/DRM fixes rather than rebasing should apply the reordered retry/recovery logic from the patchwork submission (https://patchwork.freedesktop.org/patch/730655/). Where patching cannot be done immediately, the practical compensating controls are to restrict GPU device access so that only trusted processes can open /dev/dri render nodes (tightening file permissions or using device cgroup/namespace restrictions and SELinux/AppArmor policy), and to avoid untrusted workloads that submit GPU command buffers against the msm driver; the trade-off is that this breaks GPU acceleration for the restricted applications and does not eliminate the bug for privileged or trusted GPU users who can still hang a submit and reach the recovery path. Because the defect only loads on Qualcomm Adreno hardware, systems without that GPU are not exposed and need no action beyond routine kernel updates; monitoring kernel logs for msm GPU fault/recovery messages can provide early warning of attempts to trigger the hang-recovery path.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The drm/msm driver is the Direct Rendering Manager (DRM) kernel component for Qualcomm Adreno GPUs, handling GPU command submission, memory management, and fault/hang recovery. The defect is a use-after-free (CWE-416) in the recovery path: when recovery begins after a hung submit, the code retired the hung submit before the GPU had been recovered. Retiring a submit releases its associated buffer objects (BOs), but because the GPU can still be actively accessing those BOs, freeing them prematurely leads to GPU pagefaults and subsequent instability or a kernel crash. The upstream fix reorders recovery so that hung submits are retired only after gpu recovery has completed inside recover_worker(). The affected code has been present since Linux 4.2 and is confined to builds that include the msm DRM driver, which in practice means Qualcomm Adreno hardware; the confirmed security impact is availability (denial of service) rather than memory corruption exploitable for code execution or data disclosure, consistent with the local-only, low-privilege access vector (AV:L/PR:L) and the absence of confidentiality or integrity impact in the assessed vector.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local GPU-submit interface requires a low-privilege account (AV:L/PR:L/AC:L); use-after-free manifests as GPU pagefault/crash, so A:H with no confidentiality or integrity impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
In the Linux kernel, the following vulnerability has been resolved:
drm/msm: Recover HW before retire hung submit
During recovery, it is not safe to retire the hung submit before we recover the GPU. Retiring the submit triggers BO free and that can result in GPU pagefaults since the GPU may be actively accessing those BOs.
To fix this, retire the submits after gpu recovery is complete in recover_worker().
Patchwork: https://patchwork.freedesktop.org/patch/730655/
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB