The Linux kernel vulnerability in drm/msm/gem's msm_ioctl_gem_info_get_metadata() function caused it to unconditionally return 0, ignoring error codes from copy_to_user() failures or insufficient user buffer sizes. Furthermore, kmemdup()'s return value was not checked for NULL, potentially leading to a NULL pointer dereference during copy_to_user(). The patch adds the missing NULL check and ensures the function returns the actual error code instead of 0, aligning error handling with the corresponding SET ioctl function.

Userspace applications relying on msm_ioctl_gem_info_get_metadata() may incorrectly assume successful execution despite failures, potentially causing application logic errors. The NULL pointer dereference can lead to kernel crashes, resulting in denial of service (system instability). There is no indication of confidentiality or integrity impact. The CVSS vector indicates local attack vector with low complexity, requiring low privileges, no user interaction, and resulting in availability impact only.

A fix is available and should be applied by upgrading to Linux kernel versions 7.0.0-28.28.1 or later. Users should update their Linux kernel to a patched version that includes the corrected error handling in msm_ioctl_gem_info_get_metadata().