CVE-2026-64049 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/msm/adreno: fix userspace-triggered crash on a2xx-a4xx
Before a5xx Adreno driver will not try fetching UBWC params (because those generations didn't support UBWC anyway), however it's still possible to query UBWC-related params from the userspace, triggering possible NULL pointer dereference. Check for UBWC config in adreno_get_param() and return sane defaults if there is none.
Patchwork: https://patchwork.freedesktop.org/patch/717778/
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/19/2026
This vulnerability resides within the drm/msm/adreno driver component of the Linux kernel, specifically affecting the Adreno GPU driver used in Qualcomm Snapdragon SoCs. The issue manifests as a userspace-triggered crash that occurs on a2xx through a4xx generation Adreno GPUs, representing a critical security flaw that could potentially be exploited by malicious actors. The vulnerability stems from improper handling of UBWC (Universal Bandwidth Compression) parameter queries within the driver's adreno_get_param() function, creating a condition where userspace applications can trigger unexpected behavior during GPU parameter retrieval operations.
The technical root cause involves a lack of proper validation when processing UBWC-related parameters for older GPU generations that do not support this compression technology. While the driver correctly avoids attempting to fetch UBWC parameters on a5xx generation hardware where such functionality is unavailable, it fails to implement adequate checks for earlier generations. This oversight allows userspace applications to query UBWC configuration parameters even when the underlying hardware cannot support them, resulting in a NULL pointer dereference condition that crashes the kernel and potentially compromises system stability.
The operational impact of this vulnerability extends beyond simple system crashes, as it represents a potential denial-of-service vector that could be exploited by unprivileged users or processes. Attackers could leverage this flaw to cause system instability, forcing kernel panics or complete system hangs that would require manual intervention or reboot to resolve. The vulnerability affects the broader Android ecosystem and Linux-based systems utilizing Qualcomm Snapdragon processors, particularly impacting devices where GPU acceleration is heavily utilized for graphics rendering, multimedia processing, and gaming applications.
This issue aligns with CWE-476 which addresses NULL pointer dereference conditions in software implementations, and represents a classic example of inadequate input validation within kernel space drivers. From an ATT&CK perspective, this vulnerability could be categorized under privilege escalation techniques or denial-of-service attacks, as it allows for system instability without requiring elevated privileges. The fix implemented involves adding proper checks within the adreno_get_param() function to verify UBWC configuration availability before attempting parameter retrieval and returning appropriate default values when such configurations are not supported by the target GPU generation.
The patch addresses this vulnerability by introducing conditional logic that prevents attempts to fetch UBWC parameters on hardware generations where such support does not exist. This approach follows security best practices by implementing defensive programming techniques and ensuring proper bounds checking within kernel drivers. The solution ensures that when userspace applications query UBWC-related parameters on unsupported GPU architectures, the driver gracefully handles these requests rather than crashing, maintaining system stability while providing appropriate default values that reflect the hardware limitations.
This vulnerability demonstrates the importance of thorough compatibility checking in kernel space drivers, particularly when supporting multiple generations of hardware with varying feature sets. The fix reinforces proper error handling and input validation principles that are fundamental to secure systems development, especially within the Linux kernel where driver vulnerabilities can have severe consequences for overall system integrity. The resolution maintains backward compatibility while preventing crashes that could be exploited by malicious actors seeking to compromise system stability or availability.