CVE-2026-64231: drm/msm/dsi: don't dump registers past the mapped region

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

drm/msm/dsi: don't dump registers past the mapped region

On DSI 6G platforms the IO address space is internally adjusted by
io_offset. Later this adjusted address might be used for memory dumping.
However the size that is used for memory dumping isn't adjusted to
account for the io_offset, leading to the potential access to the
unmapped region. Lower ctrl_size by the io_offset value to prevent
access past the mapped area.

 msm_disp_snapshot_add_block+0x1d4/0x3c8 [msm] (P)
 msm_dsi_host_snapshot+0x4c/0x78 [msm]
 msm_dsi_snapshot+0x28/0x50 [msm]
 msm_disp_snapshot_capture_state+0x74/0x140 [msm]
 msm_disp_snapshot_state_sync+0x60/0x90 [msm]
 _msm_disp_snapshot_work+0x30/0x90 [msm]
 kthread_worker_fn+0xdc/0x460
 kthread+0x120/0x140

Patchwork: https://patchwork.freedesktop.org/patch/721747/

The Linux kernel CVE team has assigned CVE-2026-64231 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.14 with commit bac2c6a62ed91ba4f6c7c14a6a40b7c696b35645 and fixed in 6.1.175 with commit 5e2c196c3430fb94225c4102b1028d0146544761
	Issue introduced in 5.14 with commit bac2c6a62ed91ba4f6c7c14a6a40b7c696b35645 and fixed in 6.6.142 with commit 567b5e976e2e15280d78c9ef2add1954a0bbb5b1
	Issue introduced in 5.14 with commit bac2c6a62ed91ba4f6c7c14a6a40b7c696b35645 and fixed in 6.12.92 with commit 9f8274749d9010a1a72f97e547b7eb9ebb82345b
	Issue introduced in 5.14 with commit bac2c6a62ed91ba4f6c7c14a6a40b7c696b35645 and fixed in 6.18.34 with commit a184aec790135938b0fadb415e55accd1f8685a0
	Issue introduced in 5.14 with commit bac2c6a62ed91ba4f6c7c14a6a40b7c696b35645 and fixed in 7.0.11 with commit ab871d5882953e5574ae2bc47bec88c2e3d22663
	Issue introduced in 5.14 with commit bac2c6a62ed91ba4f6c7c14a6a40b7c696b35645 and fixed in 7.1 with commit 5b49a46baa853b26dbefa65c6c75dd9ff69f63d4

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64231
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/gpu/drm/msm/dsi/dsi_host.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/5e2c196c3430fb94225c4102b1028d0146544761
	https://git.kernel.org/stable/c/567b5e976e2e15280d78c9ef2add1954a0bbb5b1
	https://git.kernel.org/stable/c/9f8274749d9010a1a72f97e547b7eb9ebb82345b
	https://git.kernel.org/stable/c/a184aec790135938b0fadb415e55accd1f8685a0
	https://git.kernel.org/stable/c/ab871d5882953e5574ae2bc47bec88c2e3d22663
	https://git.kernel.org/stable/c/5b49a46baa853b26dbefa65c6c75dd9ff69f63d4