{"cve":"CVE-2026-64039","nvd":{"published":"2026-07-19T16:17:44.153","modified":"2026-10-13T19:23:01.023","status":"Analyzed","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/snapshot: fix dumping of the unaligned regions\n\nThe snapshotting code internally aligns data segment to 16 bytes. This\nworks fine for DPU code (where most of the regions are aligned), but\nfails for snapshotting of the DSI data (because DSI data region is\nshifted by 4 bytes). Fix the code by removing length alignment and by\naccurately printing last registers in the region. While reworking the\ncode also fix the 16x memory overallocation in\nmsm_disp_state_dump_regs().\n\nPatchwork: https://patchwork.freedesktop.org/patch/725449/","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","score":7.7},"cwes":["CWE-131"],"references":["https://git.kernel.org/stable/c/070e40acc59ef7bedba0314f59971ba87fcc8ab0","https://git.kernel.org/stable/c/0c90ececfad3fc5c4c43a75ece0e2d736ab3def1","https://git.kernel.org/stable/c/1ef79be774706dddcfcace0331fa7ff32a73c73e","https://git.kernel.org/stable/c/76824d2467feb1828b745d6add2541918d7be3da","https://git.kernel.org/stable/c/8fb070cf95847b29ef6cb15ec2c0de2bf4704676"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T22:45:36.895656543+00:00"},"epss":{"cve":"CVE-2026-64039","score":0.00185,"percentile":0.08014,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}