CVE-2026-64231

drm/msm/dsi: don't dump registers past the mapped region

State: Published
Severity: Not scored
Published: Jul 24, 2026
Updated: Jul 24, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/msm/dsi: don't dump registers past the mapped region

On DSI 6G platforms the IO address space is internally adjusted by io_offset. Later this adjusted address might be used for memory dumping. However the size that is used for memory dumping isn't adjusted to account for the io_offset, leading to the potential access to the unmapped region. Lower ctrl_size by the io_offset value to prevent access past the mapped area.

msm_disp_snapshot_add_block+0x1d4/0x3c8 [msm] (P) msm_dsi_host_snapshot+0x4c/0x78 [msm] msm_dsi_snapshot+0x28/0x50 [msm] msm_disp_snapshot_capture_state+0x74/0x140 [msm] msm_disp_snapshot_state_sync+0x60/0x90 [msm] _msm_disp_snapshot_work+0x30/0x90 [msm] kthread_worker_fn+0xdc/0x460 kthread+0x120/0x140

Patchwork: https://patchwork.freedesktop.org/patch/721747/

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	bac2c6a62ed91ba4f6c7c14a6a40b7c696b35645 to before 5e2c196c3430fb94225c4102b1028d0146544761Affected bac2c6a62ed91ba4f6c7c14a6a40b7c696b35645 to before 567b5e976e2e15280d78c9ef2add1954a0bbb5b1Affected bac2c6a62ed91ba4f6c7c14a6a40b7c696b35645 to before 9f8274749d9010a1a72f97e547b7eb9ebb82345bAffected bac2c6a62ed91ba4f6c7c14a6a40b7c696b35645 to before a184aec790135938b0fadb415e55accd1f8685a0Affected bac2c6a62ed91ba4f6c7c14a6a40b7c696b35645 to before ab871d5882953e5574ae2bc47bec88c2e3d22663Affected bac2c6a62ed91ba4f6c7c14a6a40b7c696b35645 to before 5b49a46baa853b26dbefa65c6c75dd9ff69f63d4Affected
LinuxLinux	5.14Affected before 5.14Not affected 6.1.175 through 6.1.Not affected 6.6.142 through 6.6.Not affected 6.12.92 through 6.12.Not affected 6.18.34 through 6.18.Not affected 7.0.11 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

bac2c6a62ed91ba4f6c7c14a6a40b7c696b35645 to before 5e2c196c3430fb94225c4102b1028d0146544761Affected
bac2c6a62ed91ba4f6c7c14a6a40b7c696b35645 to before 567b5e976e2e15280d78c9ef2add1954a0bbb5b1Affected
bac2c6a62ed91ba4f6c7c14a6a40b7c696b35645 to before 9f8274749d9010a1a72f97e547b7eb9ebb82345bAffected
bac2c6a62ed91ba4f6c7c14a6a40b7c696b35645 to before a184aec790135938b0fadb415e55accd1f8685a0Affected
bac2c6a62ed91ba4f6c7c14a6a40b7c696b35645 to before ab871d5882953e5574ae2bc47bec88c2e3d22663Affected
bac2c6a62ed91ba4f6c7c14a6a40b7c696b35645 to before 5b49a46baa853b26dbefa65c6c75dd9ff69f63d4Affected

LinuxLinux

5.14Affected
before 5.14Not affected
6.1.175 through 6.1.*Not affected
6.6.142 through 6.6.*Not affected
6.12.92 through 6.12.*Not affected
6.18.34 through 6.18.*Not affected
7.0.11 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.