The Linux kernel driver msm_ioctl_gem_info_get_metadata() in the DRM/msm subsystem fails to propagate error codes when copy_to_user() fails or when the user buffer is too small, always returning 0 regardless of underlying errors. In addition, the function does not check if kmemdup() returns NULL on allocation failure, which leads to a NULL pointer dereference during copy_to_user(). These bugs cause kernel modules to crash or misreport success, enabling an attacker to trigger a kernel panic through a local ioctl request. The primary security impact is a denial of service due to the kernel crash, and the erroneous success return may mislead callers about the state of the metadata.

Affected deployments include all Linux kernels that incorporate the MSM DRM driver before the patch that adds null checks and correct return semantics. The patch applied in the Linux kernel repository at commit 47cbfe2608314b833ad61a65827d8fb363bc2d2d addresses the issue. No specific version ranges are disclosed in the advisory; therefore any kernel earlier than the commit that implements the fix is considered vulnerable.

The CVSS score is not provided, and the EPSS value is unavailable, so the exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. An attacker would need access to the DRM device (e.g., /dev/dri or similar) and the ability to invoke the ioctl, which is typically possible for local users on shared systems. Because the bug leads to a kernel crash, it is a high‑consequence vulnerability but may be limited by the need for privileged access to the device and lack of remote attack surface.