CVE-2026-64231 in Linux
Summary
by MITRE • 07/24/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/msm/dsi: don't dump registers past the mapped region
On DSI 6G platforms the IO address space is internally adjusted by io_offset. Later this adjusted address might be used for memory dumping. However the size that is used for memory dumping isn't adjusted to account for the io_offset, leading to the potential access to the unmapped region. Lower ctrl_size by the io_offset value to prevent access past the mapped area.
msm_disp_snapshot_add_block+0x1d4/0x3c8 [msm] (P)
msm_dsi_host_snapshot+0x4c/0x78 [msm]
msm_dsi_snapshot+0x28/0x50 [msm]
msm_disp_snapshot_capture_state+0x74/0x140 [msm]
msm_disp_snapshot_state_sync+0x60/0x90 [msm]
_msm_disp_snapshot_work+0x30/0x90 [msm]
kthread_worker_fn+0xdc/0x460 kthread+0x120/0x140
Patchwork: https://patchwork.freedesktop.org/patch/721747/
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/24/2026
This vulnerability exists within the Linux kernel's display subsystem, specifically in the drm/msm/dsi driver component that manages Display Serial Interface communication on Qualcomm Snapdragon 6G platforms. The issue stems from an improper handling of memory mapping calculations where the io_offset value is applied to adjust the IO address space but is not consistently applied to the corresponding memory dump operations. This creates a scenario where memory dumping functions access regions beyond the actual mapped memory boundaries, potentially leading to unauthorized memory access patterns that could expose sensitive data or system information.
The technical flaw manifests in the snapshot capture functionality of the display subsystem where the msm_disp_snapshot_add_block function attempts to dump register contents using incorrect size calculations. When DSI 6G platforms process IO address adjustments through io_offset, they modify the base address but fail to proportionally adjust the memory dump size parameter. This discrepancy creates a situation where memory operations attempt to access unmapped regions of physical memory, effectively bypassing normal memory protection mechanisms that should prevent such unauthorized access patterns.
The operational impact of this vulnerability extends beyond simple memory access violations and represents a potential information disclosure risk within embedded systems and mobile devices utilizing Qualcomm Snapdragon 6G platforms. Attackers could potentially exploit this flaw to dump memory contents from regions outside the intended mapped area, possibly accessing sensitive register states or system information that should remain protected. The call stack indicates this vulnerability propagates through multiple display subsystem functions including msm_dsi_host_snapshot and msm_dsi_snapshot which are part of the broader msm driver module responsible for Qualcomm display controllers.
The mitigation strategy involves adjusting the ctrl_size parameter by subtracting the io_offset value to ensure memory dump operations remain within properly mapped boundaries. This correction aligns the memory access parameters with the actual address space adjustments that occur during IO mapping operations, preventing the potential access to unmapped regions. The fix directly addresses the core calculation error in the memory management logic where the io_offset adjustment is applied inconsistently between address calculations and dump size computations, effectively resolving a class of buffer over-read vulnerabilities that could lead to information disclosure.
This vulnerability type aligns with CWE-125 Out-of-bounds Read and CWE-787 Out-of-bounds Write patterns commonly found in embedded kernel drivers where memory management calculations fail to account for hardware-specific address adjustments. The ATT&CK framework would categorize this under T1059 Command and Scripting Interpreter and potentially T1547 Persistence mechanisms if exploited in conjunction with other vulnerabilities, though the primary concern remains information disclosure rather than privilege escalation. The patch demonstrates proper defensive programming practices by ensuring consistent application of address space adjustments across all memory operations within the same subsystem, preventing similar issues from occurring in related functions that may share the same underlying calculation patterns.