Skip to main content

Linux Kernel atmel-hlcdc CVE-2026-43269

| EUVDEUVD-2026-27668 MEDIUM
Memory Leak (CWE-401)
2026-05-06 Linux GHSA-9729-xjvh-4qp8
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access to HLCDC hardware required (AV:L), any low-privilege user triggers leak via normal DRM operations (PR:L), no data exposure (C:N/I:N), memory exhaustion causes high availability impact (A:H).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 24, 2026 - 00:45 vuln.today
CVSS changed
May 08, 2026 - 19:52 NVD
5.5 (MEDIUM)
Patch available
May 06, 2026 - 13:32 EUVD
CVE Published
May 06, 2026 - 11:28 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback

After several commits, the slab memory increases. Some drm_crtc_commit objects are not freed. The atomic_destroy_state callback only put the framebuffer. Use the __drm_atomic_helper_plane_destroy_state() function to put all the objects that are no longer needed.

It has been seen after hours of usage of a graphics application or using kmemleak:

unreferenced object 0xc63a6580 (size 64): comm "egt_basic", pid 171, jiffies 4294940784 hex dump (first 32 bytes): 40 50 34 c5 01 00 00 00 ff ff ff ff 8c 65 3a c6 @P4..........e:. 8c 65 3a c6 ff ff ff ff 98 65 3a c6 98 65 3a c6 .e:......e:..e:. backtrace (crc c25aa925): kmemleak_alloc+0x34/0x3c __kmalloc_cache_noprof+0x150/0x1a4 drm_atomic_helper_setup_commit+0x1e8/0x7bc drm_atomic_helper_commit+0x3c/0x15c drm_atomic_commit+0xc0/0xf4 drm_atomic_helper_set_config+0x84/0xb8 drm_mode_setcrtc+0x32c/0x810 drm_ioctl+0x20c/0x488 sys_ioctl+0x14c/0xc20 ret_fast_syscall+0x0/0x54

AnalysisAI

Memory exhaustion in the Linux kernel's drm/atmel-hlcdc DRM driver gradually degrades availability on systems using Atmel/Microchip HLCDC display controller hardware. The atomic_destroy_state callback incorrectly releases only framebuffer references while omitting the call to __drm_atomic_helper_plane_destroy_state(), causing drm_crtc_commit objects (64 bytes each) to accumulate in kernel slab memory across every DRM atomic commit operation. Impact is limited to local denial of service through eventual OOM on embedded platforms using SAMA5 SoCs; no public exploit identified at time of analysis and EPSS is 0.02% (7th percentile), reflecting negligible exploitation interest.

Technical ContextAI

The Atmel HLCDC (High Level Clock Controller Display Controller) is a DRM subsystem driver for Microchip/Atmel SAMA5-series SoC display hardware. The root cause is CWE-401 (Missing Release of Memory after Effective Lifetime): the driver's atomic_destroy_state callback freed only the framebuffer reference but did not call __drm_atomic_helper_plane_destroy_state(), which is the DRM helper responsible for releasing all additional plane state objects - including reference-counted drm_crtc_commit objects allocated during drm_atomic_helper_setup_commit. Each DRM atomic commit (drm_atomic_commit → drm_atomic_helper_set_config → drm_mode_setcrtc → drm_ioctl) allocates a commit object that is never freed, making the leak proportional to display update frequency. The kmemleak backtrace provided in the advisory confirms the exact allocation path. CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* spans all affected stable branches prior to their respective fix commits.

RemediationAI

Update the Linux kernel to a patched stable release: 5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, 6.19.6, or 7.0. Upstream stable fix commits are available at https://git.kernel.org/stable/c/6d4e91ab97fda64e8cf9c8881cc3b4da026bd849, https://git.kernel.org/stable/c/082271e364a3205598c2e4e6233a9f49ce7941cf, and related branch-specific commits in the references. Ubuntu users should apply USN-8492-1. Red Hat and SUSE users should consult their respective security portals for backported packages. For embedded systems that cannot be immediately patched and are running sustained HLCDC graphics workloads, scheduled periodic reboots can reclaim leaked slab memory as a short-term operational workaround; this does not stop the leak but restores available memory. Enabling kmemleak (boot parameter kmemleak=on) on development or monitoring systems can confirm whether the leak is actively accumulating prior to patch deployment. There is no configuration switch to disable the faulty code path without patching, as it is triggered by any DRM atomic commit on affected hardware.

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-43269 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy