CVE-2026-46211

In the Linux kernel, the following vulnerability has been resolved:

drm/msm/gem: fix error handling in msmioctlgeminfoget_metadata()

msmioctlgeminfogetmetadata() always returns 0 regardless of errors. When copyto_user() fails or the user buffer is too small, the error code stored in ret is ignored because the function unconditionally returns 0. This causes userspace to believe the ioctl succeeded when it did not.

Additionally, kmemdup() can return NULL on allocation failure, but the return value is not checked. This leads to a NULL pointer dereference in the subsequent copytouser() call.

Add the missing NULL check for kmemdup() and return ret instead of 0.

Note that the SET counterpart (msmioctlgeminfoset_metadata) correctly returns ret.

Patchwork: https://patchwork.freedesktop.org/patch/714478/