CVE-2026-64050CWE-416

CVE-2026-64050

High · published July 19, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
5.9
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

drm/msm/dpu: don't mix devm and drmm functions

Mixing devm and drmm functions will result in a use-after-free on msm

driver teardown if userspace keeps a reference on the drm device:

The WB connector data will be destroyed because of the use of

devm_kzalloc()), while the usersoace still can try interacting with the

WB connector (which uses drmm_ functions).

Change dpu_writeback_init() to use drmm_.

Patchwork: https://patchwork.freedesktop.org/patch/722656/

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00168 · 5.9th percentile
Weakness
CWE-416 · Use After Free
Published
2026-07-19T20:17Z
Affected products (6)
ProductVersionsFixed in
linux/linux_kernel≥ 6.18, < 6.18.346.18.34
linux/linux_kernel≥ 6.19, < 7.0.117.0.11
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (3)
EPSS history
Timeline
  • 19 JUL 15:39Z
    drm/msm/dpu: don't mix devm and drmm functions
    cvelistv5