CVE-2026-64153 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN
Commit "iommu: return full error code from iommu_map_sg[_atomic]()"
changed iommu_map_sgtable() to return an ssize_t and negative values in error cases, rather than a size_t and a zero.
Store the return value in the appropriate type and in case of error, return it rather than WARNing.
Patchwork: https://patchwork.freedesktop.org/patch/719685/
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/20/2026
The vulnerability resides within the Linux kernel's graphics subsystem, specifically in the msm (Mobile Station Module) driver component that handles display rendering operations. This issue stems from an improper handling of return values from IOMMU (Input-Output Memory Management Unit) mapping functions, which are critical for memory protection and virtualization in graphics processing contexts. The problem manifests when the iommu_map_sgtable() function fails to properly propagate error conditions back to calling code, instead triggering kernel warnings that can obscure the actual failure conditions.
The technical flaw originates from a change in the IOMMU subsystem where the iommu_map_sgtable() function was modified to return ssize_t values rather than size_t values, with negative return codes indicating errors. This change was introduced through commit "iommu: return full error code from iommu_map_sg[_atomic]()" which properly standardized error reporting across IOMMU operations. However, the msm driver failed to update its handling of this function's return value to accommodate the new signed integer return type, creating a mismatch between expected and actual return value semantics.
The operational impact of this vulnerability compromises system stability and security integrity within graphics processing pipelines. When IOMMU mapping operations fail, the improper error handling causes the kernel to issue WARN messages instead of properly propagating error codes back to the calling functions. This behavior can lead to subsequent memory management failures, potential privilege escalation opportunities, or complete system crashes depending on how the graphics subsystem handles these undetected errors. The vulnerability particularly affects devices using msm drivers for display operations where IOMMU protection is critical for preventing unauthorized memory access.
The fix implemented addresses this through proper type casting and error propagation mechanisms that ensure negative return values from iommu_map_sgtable() are correctly stored in ssize_t variables rather than being implicitly converted to size_t types that would mask error conditions. This change aligns with CWE-704 (Incorrect Type Conversion or Cast) and follows ATT&CK technique T1068 (Local Privilege Escalation) mitigation principles by ensuring proper error handling prevents exploitation of memory management flaws. The resolution prevents kernel warnings from being generated in error conditions while maintaining proper error propagation to higher-level drivers, thereby preserving system stability and security boundaries that IOMMU operations are designed to enforce.
This vulnerability demonstrates the critical importance of maintaining consistency across kernel subsystems when API changes occur, particularly in memory management components where improper error handling can create security vulnerabilities. The fix reinforces proper defensive programming practices by ensuring that error conditions are not only detected but properly propagated through the call stack, preventing situations where kernel warnings mask actual operational failures that could be exploited by malicious actors or cause system instability during graphics-intensive operations.