Skip to main content

Linux Kernel CVE-2026-43236

| EUVDEUVD-2026-27797 HIGH
Use After Free (CWE-416)
2026-05-06 Linux GHSA-j77r-m2hp-2792
Information Disclosure Linux Use After Free Memory Corruption Red Hat Suse
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SUSE
HIGH
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Analysis Generated
May 08, 2026 - 13:41 vuln.today
CVSS changed
May 08, 2026 - 13:22 NVD
7.8 (HIGH)
Patch available
May 06, 2026 - 13:32 EUVD
CVE Published
May 06, 2026 - 11:28 nvd
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release

The atmel_hlcdc_plane_atomic_duplicate_state() callback was copying the atmel_hlcdc_plane state structure without properly duplicating the drm_plane_state. In particular, state->commit remained set to the old state commit, which can lead to a use-after-free in the next drm_atomic_commit() call.

Fix this by calling __drm_atomic_helper_duplicate_plane_state(), which correctly clones the base drm_plane_state (including the ->commit pointer).

It has been seen when closing and re-opening the device node while another DRM client (e.g. fbdev) is still attached:

================= BUG kmalloc-64 (Not tainted): Poison overwritten -----------------------------------------------------------------------------

0xc611b344-0xc611b344 @offset=836. First byte 0x6a instead of 0x6b FIX kmalloc-64: Restoring Poison 0xc611b344-0xc611b344=0x6b Allocated in drm_atomic_helper_setup_commit+0x1e8/0x7bc age=178 cpu=0 pid=29 drm_atomic_helper_setup_commit+0x1e8/0x7bc drm_atomic_helper_commit+0x3c/0x15c drm_atomic_commit+0xc0/0xf4 drm_framebuffer_remove+0x4cc/0x5a8 drm_mode_rmfb_work_fn+0x6c/0x80 process_one_work+0x12c/0x2cc worker_thread+0x2a8/0x400 kthread+0xc0/0xdc ret_from_fork+0x14/0x28 Freed in drm_atomic_helper_commit_hw_done+0x100/0x150 age=8 cpu=0 pid=169 drm_atomic_helper_commit_hw_done+0x100/0x150 drm_atomic_helper_commit_tail+0x64/0x8c commit_tail+0x168/0x18c drm_atomic_helper_commit+0x138/0x15c drm_atomic_commit+0xc0/0xf4 drm_atomic_helper_set_config+0x84/0xb8 drm_mode_setcrtc+0x32c/0x810 drm_ioctl+0x20c/0x488 sys_ioctl+0x14c/0xc20 ret_fast_syscall+0x0/0x54 Slab 0xef8bc360 objects=21 used=16 fp=0xc611b7c0 flags=0x200(workingset|zone=0) Object 0xc611b340 @offset=832 fp=0xc611b7c0

AnalysisAI

Use-after-free in Linux kernel's Atmel HLCDC DRM driver allows local authenticated users to execute arbitrary code, escalate privileges, or cause denial of service. The atmel_hlcdc_plane_atomic_duplicate_state() function incorrectly copies plane state without properly duplicating the drm_plane_state structure, leaving a stale commit pointer that triggers use-after-free during subsequent drm_atomic_commit() calls. Vulnerability surfaces when reopening the device node while another DRM client remains attached. EPSS score is low (0.02%) and no active exploitation confirmed at time of analysis, but local privilege escalation potential and vendor-released patches across multiple stable kernel branches indicate genuine risk for systems using Atmel HLCDC display hardware.

Technical ContextAI

This vulnerability affects the Direct Rendering Manager (DRM) subsystem in the Linux kernel, specifically the Atmel High-end LCD Controller (HLCDC) driver used for display management on Atmel/Microchip ARM SoCs. The issue stems from improper state management during atomic modesetting operations. When duplicating plane state during atomic commits, the driver's atmel_hlcdc_plane_atomic_duplicate_state() callback performs a shallow copy that fails to properly clone the base drm_plane_state structure. Most critically, the state->commit pointer remains pointing to the old commit object, which may already be freed. This violates the DRM atomic API contract where each duplicated state must have independent lifecycle management for commit tracking objects. When drm_atomic_helper_commit() subsequently accesses this dangling pointer during the next atomic commit, it triggers use-after-free conditions. The vulnerability manifests in scenarios involving multiple concurrent DRM clients (e.g., fbdev emulation and userspace compositor) or device node close/reopen sequences, which are common in embedded systems with framebuffer console fallbacks. The fix invokes __drm_atomic_helper_duplicate_plane_state() to ensure proper reference counting and cloning of the commit pointer.

RemediationAI

Update to patched kernel versions: 5.10.252+, 5.15.202+, 6.1.165+, 6.6.128+, 6.12.75+, 6.18.16+, 6.19.6+, or 7.0+ depending on current stable branch. Upstream fix commits available at https://git.kernel.org/stable/c/fd4a4d0711f48a99b25bcd45e00eef8339eff82d and branch-specific backports listed in references. For systems unable to immediately patch, disable the Atmel HLCDC DRM driver by blacklisting the atmel-hlcdc module (modprobe.blacklist=atmel_hlcdc) and use alternative framebuffer drivers, though this eliminates hardware-accelerated graphics and may break display functionality on affected SoCs. Restrict access to /dev/dri/card* device nodes to trusted users only via udev rules, reducing attack surface by preventing unprivileged local users from triggering the vulnerable code path through DRM ioctl operations. This mitigation trades graphics subsystem functionality for security on unpatched systems. Monitor kernel logs for SLUB/KASAN use-after-free warnings in drm_atomic paths as potential exploitation indicators. No userspace configuration changes can fully mitigate the kernel memory corruption risk.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-43236 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy