Bug 2502529 (CVE-2026-64154)

Summary:	CVE-2026-64154 kernel: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init()
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel's Adreno graphics processing unit (GPU) driver. This vulnerability occurs in the `a6xx_gpu_init()` function, where a device node reference is not properly released under certain error conditions. This oversight can lead to a gradual accumulation of unreleased resources, potentially causing resource exhaustion over extended periods of operation. While not directly exploitable for arbitrary code execution, this resource management issue could impact system stability and availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-19 17:04:32 UTC

In the Linux kernel, the following vulnerability has been resolved:

drm/msm/adreno: Fix a reference leak in a6xx_gpu_init()

In a6xx_gpu_init(), node is obtained via of_parse_phandle().
While there was a manual of_node_put() at the end of the
common path, several early error returns would bypass this call,
resulting in a reference leak.
Fix this by using the __free(device_node) cleanup handler to
release the reference when the variable goes out of scope.

Patchwork: https://patchwork.freedesktop.org/patch/700661/

Comment 1 TEJ RATHI 2026-07-20 11:18:07 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026071932-CVE-2026-64154-a112@gregkh/T