CVE-2026-64231 drm/msm/dsi: don't dump registers past the mapped region
A flaw in the Linux kernel MSM DSI driver allows reading unmapped memory regions during register dumps, potentially disclosing sensitive kernel data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64231?
CVE-2026-64231 is a medium-severity vulnerability in Linux kernel, published on 24 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/msm/dsi: don't dump registers past the mapped region
On DSI 6G platforms the IO address space is internally adjusted by io_offset. Later this adjusted address might be used for memory dumping. However the size that is used for memory dumping isn't adjusted to account for the io_offset, leading to the potential access to the unmapped region. Lower ctrl_size by the io_offset value to prevent access past the mapped area.
msm_disp_snapshot_add_block+0x1d4/0x3c8 [msm] (P) msm_dsi_host_snapshot+0x4c/0x78 [msm] msm_dsi_snapshot+0x28/0x50 [msm] msm_disp_snapshot_capture_state+0x74/0x140 [msm] msm_disp_snapshot_state_sync+0x60/0x90 [msm] _msm_disp_snapshot_work+0x30/0x90 [msm] kthread_worker_fn+0xdc/0x460 kthread+0x120/0x140
Patchwork: https://patchwork.freedesktop.org/patch/721747/
Which versions are affected by CVE-2026-64231?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-64231?
Apply the vendor's patch.
Is CVE-2026-64231 being exploited?
There is no known exploitation of CVE-2026-64231 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-64231, DEBIAN-CVE-2026-64231, GHSA-pcwg-q9xc-9m5v, ROOT-OS-UBUNTU-2204-CVE-2026-64231, UBUNTU-CVE-2026-64231.