CVE-2026-93183 - Vulnerability Details

- drm/lima: call drm_mm_init() with a valid allocation range

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/lima: call drm_mm_init() with a valid allocation range

lima_vm_create() is currently run before va_start and va_end are set up,
meaning they are both 0. lima_vm_create() runs drm_mm_init() with them
as arguments for the allocator, and if DRM_DEBUG_MM is enabled the
DRM_MM_BUG_ON check in drm_mm_init then fires, as seen here on
exynos4412-odroid-u2:

[ 1.736297] ------------[ cut here ]------------
[ 1.740370] kernel BUG at drivers/gpu/drm/drm_mm.c:931!
[ 1.745574] Internal error: Oops - BUG: 0 [#1] SMP ARM
[ 1.750697] Modules linked in:
[ 1.753734] CPU: 0 UID: 0 PID: 41 Comm: kworker/u16:1 Not tainted 7.0.10-postmarketos-exynos4 #11 PREEMPT
[ 1.763372] Hardware name: Samsung Exynos (Flattened Device Tree)
[ 1.769446] Workqueue: events_unbound deferred_probe_work_func
[ 1.775261] PC is at drm_mm_init+0x9c/0xa4
[ 1.779339] LR is at lima_vm_create+0x144/0x17c
[ ... ]

Fix the issue by moving the lima_vm_create() call after va_start and
va_end are set up.

Published: 2026-09-17

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A defect in the Linux kernel’s Lima DRM driver causes the allocator drm_mm_init to be called before the virtual address range is initialized, leading to a kernel assertion failure and a system crash. The failure occurs when va_start and va_end remain zero, so drm_mm_init receives an invalid range and triggers a BUG. The consequence is a kernel panic that disrupts system operation and results in a loss of availability.

Affected Systems

All Linux kernel releases that include the Lima DRM driver are affected, including the 7.0.10-postmarketos-exynos4 kernel and other versions using the same buggy sequence. The issue is specific to systems that load the Lima driver during boot or device initialization.

Risk and Exploitability

The EPSS score is below 1%, indicating a very low probability of exploitation as reflected in current data. The flaw does not provide a remote code‑execution path; it requires interaction with the device driver during initialization. The vulnerability is not listed in the CISA KEV catalog, and no CVSS score is supplied, but the kernel panic demonstrates a high impact on availability for affected systems.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`a1d2a6339961efc078208dc3b2f006e9e9a8e119`	affected	< af1f276d50c9d7ebcd25770f358ca503a89d96d7
`a1d2a6339961efc078208dc3b2f006e9e9a8e119`	affected	< fd6bc5f1d6b54047b06b82bab25a7e21e4b1c95a
`a1d2a6339961efc078208dc3b2f006e9e9a8e119`	affected	< ad4e908096dff97646f77b04e2e2825225e215f7
`a1d2a6339961efc078208dc3b2f006e9e9a8e119`	affected	< 788917ba77f5d69bd368c1d176ecceda346a2951
`a1d2a6339961efc078208dc3b2f006e9e9a8e119`	affected	< 79a3331ee436c8b1454f897d539606c9b5ebdf9f
`a1d2a6339961efc078208dc3b2f006e9e9a8e119`	affected	< e2a7cee341986cb5b544a8286edc7fb0494c592e
`a1d2a6339961efc078208dc3b2f006e9e9a8e119`	affected	< e0773ad25a34a49aece176721c466cf214e02222
`a1d2a6339961efc078208dc3b2f006e9e9a8e119`	affected	< 3b3bce4a692ac60d9f4a341e6b597dd1fd0a28f9

Linux

affected

Version	Status	Constraints
`5.2`	affected	—
`0`	unaffected	< 5.2
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.52`	unaffected	≤ 6.18.*
`7.2.6`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[a1d2a6339961efc078208dc3b2f006e9e9a8e119,af1f276d50c9d7ebcd25770f358ca503a89d96d7)`	affected	code_commit	—
`[a1d2a6339961efc078208dc3b2f006e9e9a8e119,fd6bc5f1d6b54047b06b82bab25a7e21e4b1c95a)`	affected	code_commit	—
`[a1d2a6339961efc078208dc3b2f006e9e9a8e119,ad4e908096dff97646f77b04e2e2825225e215f7)`	affected	code_commit	—
`[a1d2a6339961efc078208dc3b2f006e9e9a8e119,788917ba77f5d69bd368c1d176ecceda346a2951)`	affected	code_commit	—
`[a1d2a6339961efc078208dc3b2f006e9e9a8e119,79a3331ee436c8b1454f897d539606c9b5ebdf9f)`	affected	code_commit	—
`[a1d2a6339961efc078208dc3b2f006e9e9a8e119,e0773ad25a34a49aece176721c466cf214e02222)`	affected	code_commit	—
`[a1d2a6339961efc078208dc3b2f006e9e9a8e119,e2a7cee341986cb5b544a8286edc7fb0494c592e)`	affected	code_commit	—
`[a1d2a6339961efc078208dc3b2f006e9e9a8e119,3b3bce4a692ac60d9f4a341e6b597dd1fd0a28f9)`	affected	code_commit	—
`[a1d2a6339961efc078208dc3b2f006e9e9a8e119,3b3bce4a692ac60d9f4a341e6b597dd1fd0a28f9)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.2`	affected	generic	—
`[0,5.2)`	unaffected	generic	—
`[5.10.270,5.10.*]`	unaffected	generic	—
`[5.15.221,5.15.*]`	unaffected	generic	—
`[6.1.188,6.1.*]`	unaffected	generic	—
`[6.6.157,6.6.*]`	unaffected	generic	—
`[6.12.110,6.12.*]`	unaffected	generic	—
`[6.18.52,6.18.*]`	unaffected	generic	—
`[7.2.6,7.2.*]`	unaffected	generic	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply a kernel update that includes the fix that moves the lima_vm_create call after va_start and va_end are set up
If an immediate kernel update is not available, disable or unload the Lima DRM driver to prevent the faulty initialization
Verify system logs for any occurrences of drm_mm_init or kernel BUG messages; investigate and remediate any pending driver load failures

Generated by OpenCVE AI on September 19, 2026 at 08:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00211.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/3b3bce4a692ac60d9f4a341e6b597dd1fd0a28f9
https://git.kernel.org/stable/c/788917ba77f5d69bd368c1d176ecceda346a2951
https://git.kernel.org/stable/c/79a3331ee436c8b1454f897d539606c9b5ebdf9f
https://git.kernel.org/stable/c/ad4e908096dff97646f77b04e2e2825225e215f7
https://git.kernel.org/stable/c/af1f276d50c9d7ebcd25770f358ca503a89d96d7
https://git.kernel.org/stable/c/e0773ad25a34a49aece176721c466cf214e02222
https://git.kernel.org/stable/c/e2a7cee341986cb5b544a8286edc7fb0494c592e
https://git.kernel.org/stable/c/fd6bc5f1d6b54047b06b82bab25a7e21e4b1c95a

History

Sat, 19 Sep 2026 09:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-665

Thu, 17 Sep 2026 16:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: drm/lima: call drm_mm_init() with a valid allocation range lima_vm_create() is currently run before va_start and va_end are set up, meaning they are both 0. lima_vm_create() runs drm_mm_init() with them as arguments for the allocator, and if DRM_DEBUG_MM is enabled the DRM_MM_BUG_ON check in drm_mm_init then fires, as seen here on exynos4412-odroid-u2: [ 1.736297] ------------[ cut here ]------------ [ 1.740370] kernel BUG at drivers/gpu/drm/drm_mm.c:931! [ 1.745574] Internal error: Oops - BUG: 0 [#1] SMP ARM [ 1.750697] Modules linked in: [ 1.753734] CPU: 0 UID: 0 PID: 41 Comm: kworker/u16:1 Not tainted 7.0.10-postmarketos-exynos4 #11 PREEMPT [ 1.763372] Hardware name: Samsung Exynos (Flattened Device Tree) [ 1.769446] Workqueue: events_unbound deferred_probe_work_func [ 1.775261] PC is at drm_mm_init+0x9c/0xa4 [ 1.779339] LR is at lima_vm_create+0x144/0x17c [ ... ] Fix the issue by moving the lima_vm_create() call after va_start and va_end are set up.
Title		drm/lima: call drm_mm_init() with a valid allocation range
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/3b3bce4a692ac60d9f4a341e6b597dd1fd0a28f9 https://git.kernel.org/stable/c/788917ba77f5d69bd368c1d176ecceda346a2951 https://git.kernel.org/stable/c/79a3331ee436c8b1454f897d539606c9b5ebdf9f https://git.kernel.org/stable/c/ad4e908096dff97646f77b04e2e2825225e215f7 https://git.kernel.org/stable/c/af1f276d50c9d7ebcd25770f358ca503a89d96d7 https://git.kernel.org/stable/c/e0773ad25a34a49aece176721c466cf214e02222 https://git.kernel.org/stable/c/e2a7cee341986cb5b544a8286edc7fb0494c592e https://git.kernel.org/stable/c/fd6bc5f1d6b54047b06b82bab25a7e21e4b1c95a

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-17T16:12:10.072Z

Updated: 2026-09-17T16:12:10.072Z

Reserved: 2026-09-17T16:02:15.091Z

Link: CVE-2026-93183

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-17T17:18:14.290

Modified: 2026-09-17T17:18:14.290

Link: CVE-2026-93183

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-20T06:45:17Z

Weaknesses

CWE-665
Improper Initialization

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object