LiveActive security incident?Get immediate response
CVE Record

CVE-2026-46211: drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata()

In the Linux kernel, the following vulnerability has been resolved: drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata() msm_ioctl_gem_info_get_metadata() always returns 0 regardless of errors. When copy_to_user() fails or the user buffer is too small, the error code stored in ret is ignored because the function unconditionally returns 0. This causes userspace to believe the ioctl succeeded when it did not. Additionally, kmemdup() can return NULL on allocation failure, but the return value is not checked. This leads to a NULL pointer dereference in the subsequent copy_to_user() call. Add the missing NULL check for kmemdup() and return ret instead of 0. Note that the SET counterpart (msm_ioctl_gem_info_set_metadata) correctly returns ret. Patchwork: https://patchwork.freedesktop.org/patch/714478/

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2026-46211 is a Linux kernel bug in the drm/msm GEM metadata ioctl path. Failed metadata reads could be reported as successful, and an allocation failure could cause a NULL pointer dereference. The sources do not provide a CVSS score, active exploitation evidence, or a business-impact assessment.

Executive priority

Treat this as a kernel maintenance item until vendor severity guidance is available. Prioritize systems where untrusted local users or workloads can access affected DRM interfaces, but do not treat it as internet-exposed based on the provided evidence.

Technical view

msm_ioctl_gem_info_get_metadata() ignored stored error codes and always returned success. It also failed to check kmemdup() for NULL before copy_to_user(). The fix adds the missing allocation check and returns the actual ret value, matching the SET metadata counterpart behavior.

Likely exposure

Exposure appears limited to Linux systems running affected kernel versions with the drm/msm GEM metadata ioctl path available to userspace. The source bundle does not identify specific distributions, devices, configurations, or remote attack paths.

Exploitation context

The source bundle marks KEV as false and provides no cited evidence of exploitation in the wild. Based on the description, any abuse would require local userspace interaction with the affected ioctl, but practical exploitability is not established in the provided sources.

Researcher notes

Key issues are incorrect success reporting on copy_to_user or short-buffer failures, plus unchecked kmemdup allocation failure. The provided record lacks CWE, CVSS, exploitability analysis, and distribution-specific affected ranges, so validation should focus on code lineage and vendor backports.

Mitigation direction

  • Review vendor or distribution advisories for patched kernel packages.
  • Prioritize kernel updates that include the listed stable fixes.
  • Restrict untrusted local access to affected GPU/DRM device nodes where feasible.
  • Track affected fleet kernels against the CVE and stable commit references.

Validation and detection

  • Inventory Linux kernel versions on systems using drm/msm.
  • Confirm whether vendor kernels include one of the referenced fixes.
  • Check device exposure for userspace access to the relevant DRM path.
  • Verify package advisories rather than relying only on upstream version numbers.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-46211 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
5Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux9902cb999e4e913d98e8afe4b36c08e4a793e1ce, 9902cb999e4e913d98e8afe4b36c08e4a793e1ce, 9902cb999e4e913d98e8afe4b36c08e4a793e1ce, 9902cb999e4e913d98e8afe4b36c08e4a793e1ceunaffected
LinuxLinux6.8, 0, 6.12.90, 6.18.32, 7.0.9, 7.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.