CVE-2026-46211

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata()<br /> <br /> msm_ioctl_gem_info_get_metadata() always returns 0 regardless of<br /> errors. When copy_to_user() fails or the user buffer is too small,<br /> the error code stored in ret is ignored because the function<br /> unconditionally returns 0. This causes userspace to believe the<br /> ioctl succeeded when it did not.<br /> <br /> Additionally, kmemdup() can return NULL on allocation failure, but<br /> the return value is not checked. This leads to a NULL pointer<br /> dereference in the subsequent copy_to_user() call.<br /> <br /> Add the missing NULL check for kmemdup() and return ret instead of 0.<br /> <br /> Note that the SET counterpart (msm_ioctl_gem_info_set_metadata)<br /> correctly returns ret.<br /> <br /> Patchwork: https://patchwork.freedesktop.org/patch/714478/