Skip to main content

Linux Kernel EUVDEUVD-2026-25464

| CVE-2026-31571 MEDIUM
2026-04-24 Linux GHSA-r966-3cpg-694w
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access to DRM device node required (AV:L, PR:L); no confidentiality or integrity impact per description; availability high due to kernel WARN and state corruption.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 03:08 vuln.today
CVSS changed
Apr 27, 2026 - 20:37 NVD
5.5 (MEDIUM)
Patch released
Apr 27, 2026 - 20:33 nvd
Patch available
Patch available
Apr 24, 2026 - 16:16 EUVD
EUVD ID Assigned
Apr 24, 2026 - 15:00 euvd
EUVD-2026-25464
CVE Published
Apr 24, 2026 - 14:35 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/i915: Unlink NV12 planes earlier

unlink_nv12_plane() will clobber parts of the plane state potentially already set up by plane_atomic_check(), so we must make sure not to call the two in the wrong order. The problem happens when a plane previously selected as a Y plane is now configured as a normal plane by user space. plane_atomic_check() will first compute the proper plane state based on the userspace request, and unlink_nv12_plane() later clears some of the state.

This used to work on account of unlink_nv12_plane() skipping the state clearing based on the plane visibility. But I removed that check, thinking it was an impossible situation. Now when that situation happens unlink_nv12_plane() will just WARN and proceed to clobber the state.

Rather than reverting to the old way of doing things, I think it's more clear if we unlink the NV12 planes before we even compute the new plane state.

(cherry picked from commit 017ecd04985573eeeb0745fa2c23896fb22ee0cc)

AnalysisAI

State ordering regression in the Linux kernel's drm/i915 Intel graphics driver causes unlink_nv12_plane() to clobber plane state already computed by plane_atomic_check(), resulting in a kernel WARN and availability disruption on systems with Intel i915 GPUs. The flaw affects local users with DRM device access who configure a plane previously used as an NV12 Y plane back to a normal plane. No public exploit exists and EPSS sits at 0.02% (4th percentile), confirming this as a low-probability exploitation scenario; however, the patch is available across multiple stable kernel branches.

Technical ContextAI

The drm/i915 subsystem implements Intel's Direct Rendering Manager driver for i915-family integrated and discrete GPUs. NV12 is a planar YUV format requiring a Y plane and a UV plane, tracked separately in the kernel's DRM atomic state machine. The bug is a function call ordering error: plane_atomic_check() computes and stores updated plane state, but a subsequent call to unlink_nv12_plane() - which was intended to run earlier - incorrectly clears portions of that freshly computed state. A prior guard (visibility-based skip) historically prevented the clobber from occurring, but a developer removed that guard believing the condition was impossible. The root cause class is CWE not formally assigned, but maps closest to CWE-664 (Improper Control of a Resource Through its Lifetime) - specifically an operation sequencing violation where resource state is modified out of order. Affected CPEs are cpe:2.3:a:linux:linux (broad), requiring an Intel i915 GPU and DRM atomic modesetting support to be present.

RemediationAI

The primary fix is upgrading to a patched kernel version: Linux 6.18.21 or later for the 6.18 stable branch, Linux 6.19.11 or later for the 6.19 stable branch, or mainline kernels incorporating the fix commit cherry-picked from 017ecd04985573eeeb0745fa2c23896fb22ee0cc. Stable-tree fix commits are available at https://git.kernel.org/stable/c/70e2eb91cb6310a3508439f6f2539dfffa0abf77, https://git.kernel.org/stable/c/12f3b6cbab8fbeb95097685b40f0147406cf9746, and https://git.kernel.org/stable/c/bfa71b7a9dc6b5b8af157686e03308291141d00c. Red Hat and SUSE advisory channels should be monitored for distribution-specific kernel updates. As a workaround on systems where patching is temporarily infeasible, restricting unprivileged access to /dev/dri/* device nodes (e.g., via udev rules or group membership controls) limits the attack surface to root-level processes, significantly reducing exploitation opportunity at the cost of breaking user-space GPU access for non-root DRM applications.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

EUVD-2026-25464 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy