CVE-2026-64050 - Vulnerability Details - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: don't mix devm and drmm functions Mixing devm and drmm functions will result in a use-after-free on msm driver teardown if userspace keeps a reference on the drm device: The WB connector data will be destroyed because of the use of devm_kzalloc()), while the usersoace still can try interacting with the WB connector (which uses drmm_ functions). Change dpu_writeback_init() to use drmm_. Patchwork: https://patchwork.freedesktop.org/patch/722656/

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Vendors	Products
Linux	Linux Kernel

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/95048a12f48c627bc2ccc4d84f87640630ba2bdb
https://git.kernel.org/stable/c/c0c70a11365cba7fba25a77463582bcec0f7846e
https://git.kernel.org/stable/c/ff58e5ef1b46ce614af048d2d04986df05ffab90

History

Sun, 19 Jul 2026 16:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: don't mix devm and drmm functions Mixing devm and drmm functions will result in a use-after-free on msm driver teardown if userspace keeps a reference on the drm device: The WB connector data will be destroyed because of the use of devm_kzalloc()), while the usersoace still can try interacting with the WB connector (which uses drmm_ functions). Change dpu_writeback_init() to use drmm_. Patchwork: https://patchwork.freedesktop.org/patch/722656/
Title		drm/msm/dpu: don't mix devm and drmm functions
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/95048a12f48c627bc2ccc4d84f87640630ba2bdb https://git.kernel.org/stable/c/c0c70a11365cba7fba25a77463582bcec0f7846e https://git.kernel.org/stable/c/ff58e5ef1b46ce614af048d2d04986df05ffab90

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T15:39:33.942Z

Updated: 2026-07-19T15:39:33.942Z

Reserved: 2026-07-19T07:54:57.029Z

Link: CVE-2026-64050

Vulnrichment

No data.

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64050", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.029Z", "datePublished": "2026-07-19T15:39:33.942Z", "dateUpdated": "2026-07-19T15:39:33.942Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-07-19T15:39:33.942Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/dpu: don't mix devm and drmm functions\n\nMixing devm and drmm functions will result in a use-after-free on msm\ndriver teardown if userspace keeps a reference on the drm device:\nThe WB connector data will be destroyed because of the use of\ndevm_kzalloc()), while the usersoace still can try interacting with the\nWB connector (which uses drmm_ functions).\n\nChange dpu_writeback_init() to use drmm_.\n\nPatchwork: https://patchwork.freedesktop.org/patch/722656/"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/msm/disp/dpu1/dpu_writeback.c"], "versions": [{"version": "0b37ac63fc9db7779168ad18d7e6e8ab9df6a40b", "lessThan": "ff58e5ef1b46ce614af048d2d04986df05ffab90", "status": "affected", "versionType": "git"}, {"version": "0b37ac63fc9db7779168ad18d7e6e8ab9df6a40b", "lessThan": "95048a12f48c627bc2ccc4d84f87640630ba2bdb", "status": "affected", "versionType": "git"}, {"version": "0b37ac63fc9db7779168ad18d7e6e8ab9df6a40b", "lessThan": "c0c70a11365cba7fba25a77463582bcec0f7846e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/msm/disp/dpu1/dpu_writeback.c"], "versions": [{"version": "6.18", "status": "affected"}, {"version": "0", "lessThan": "6.18", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.34", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.11", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "6.18.34"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.0.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ff58e5ef1b46ce614af048d2d04986df05ffab90"}, {"url": "https://git.kernel.org/stable/c/95048a12f48c627bc2ccc4d84f87640630ba2bdb"}, {"url": "https://git.kernel.org/stable/c/c0c70a11365cba7fba25a77463582bcec0f7846e"}], "title": "drm/msm/dpu: don't mix devm and drmm functions", "x_generator": {"engine": "bippy-1.2.0"}}}}