The Linux kernel DRM/ MSM driver contains a function that incorrectly returns success even when copying data to userspace fails, and it also fails to check for a NULL pointer from a memory allocation. The function therefore can both mislead userspace into believing an operation succeeded and cause a kernel panic through a NULL dereference. This flaw would allow an attacker to trigger a denial of service but does not give any escalation of privileges or remote access.

All versions of the Linux kernel that include the MSM driver before the commit 47cbfe2608314b833ad61a65827d8fb363bc2d2d are vulnerable. Users need to check their running kernel against that commit; otherwise the kernel is considered affected. The vulnerability applies to the general Linux kernel, with no specific vendor distribution version range listed.

The CVSS score is 5.5, and the EPSS score is less than 1 %, indicating a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local: an attacker must have access to a DRM device node such as /dev/dri/card0 and normal user privileges. Successful exploitation would result in a kernel panic or denial of service for all users on the affected system. No privilege escalation or remote compromise can be achieved.