CVE-2026-93183

drm/lima: call drm_mm_init() with a valid allocation range

State: Published
Severity: Not scored
Published: Sep 17, 2026
Updated: Oct 19, 2026
Reserved: Sep 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/lima: call drm_mm_init() with a valid allocation range

lima_vm_create() is currently run before va_start and va_end are set up, meaning they are both 0. lima_vm_create() runs drm_mm_init() with them as arguments for the allocator, and if DRM_DEBUG_MM is enabled the DRM_MM_BUG_ON check in drm_mm_init then fires, as seen here on exynos4412-odroid-u2:

[ 1.736297] ------------[ cut here ]------------ [ 1.740370] kernel BUG at drivers/gpu/drm/drm_mm.c:931! [ 1.745574] Internal error: Oops - BUG: 0 [#1] SMP ARM [ 1.750697] Modules linked in: [ 1.753734] CPU: 0 UID: 0 PID: 41 Comm: kworker/u16:1 Not tainted 7.0.10-postmarketos-exynos4 #11 PREEMPT [ 1.763372] Hardware name: Samsung Exynos (Flattened Device Tree) [ 1.769446] Workqueue: events_unbound deferred_probe_work_func [ 1.775261] PC is at drm_mm_init+0x9c/0xa4 [ 1.779339] LR is at lima_vm_create+0x144/0x17c [ ... ]

Fix the issue by moving the lima_vm_create() call after va_start and va_end are set up.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	a1d2a6339961efc078208dc3b2f006e9e9a8e119 to before af1f276d50c9d7ebcd25770f358ca503a89d96d7Affected a1d2a6339961efc078208dc3b2f006e9e9a8e119 to before fd6bc5f1d6b54047b06b82bab25a7e21e4b1c95aAffected a1d2a6339961efc078208dc3b2f006e9e9a8e119 to before ad4e908096dff97646f77b04e2e2825225e215f7Affected a1d2a6339961efc078208dc3b2f006e9e9a8e119 to before 788917ba77f5d69bd368c1d176ecceda346a2951Affected a1d2a6339961efc078208dc3b2f006e9e9a8e119 to before 79a3331ee436c8b1454f897d539606c9b5ebdf9fAffected a1d2a6339961efc078208dc3b2f006e9e9a8e119 to before e2a7cee341986cb5b544a8286edc7fb0494c592eAffected a1d2a6339961efc078208dc3b2f006e9e9a8e119 to before e0773ad25a34a49aece176721c466cf214e02222Affected a1d2a6339961efc078208dc3b2f006e9e9a8e119 to before 3b3bce4a692ac60d9f4a341e6b597dd1fd0a28f9Affected
LinuxLinux	5.2Affected before 5.2Not affected 5.10.270 through 5.10.Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.52 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

a1d2a6339961efc078208dc3b2f006e9e9a8e119 to before af1f276d50c9d7ebcd25770f358ca503a89d96d7Affected
a1d2a6339961efc078208dc3b2f006e9e9a8e119 to before fd6bc5f1d6b54047b06b82bab25a7e21e4b1c95aAffected
a1d2a6339961efc078208dc3b2f006e9e9a8e119 to before ad4e908096dff97646f77b04e2e2825225e215f7Affected
a1d2a6339961efc078208dc3b2f006e9e9a8e119 to before 788917ba77f5d69bd368c1d176ecceda346a2951Affected
a1d2a6339961efc078208dc3b2f006e9e9a8e119 to before 79a3331ee436c8b1454f897d539606c9b5ebdf9fAffected
a1d2a6339961efc078208dc3b2f006e9e9a8e119 to before e2a7cee341986cb5b544a8286edc7fb0494c592eAffected
a1d2a6339961efc078208dc3b2f006e9e9a8e119 to before e0773ad25a34a49aece176721c466cf214e02222Affected
a1d2a6339961efc078208dc3b2f006e9e9a8e119 to before 3b3bce4a692ac60d9f4a341e6b597dd1fd0a28f9Affected

LinuxLinux

5.2Affected
before 5.2Not affected
5.10.270 through 5.10.*Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.52 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.