Skip to main content

Linux Kernel i915 EUVDEUVD-2026-59351

| CVE-2026-72452 HIGH
2026-08-15 Linux GHSA-fg7v-qr3p-44mc
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

AC raised to H because triggering the double-free requires specific DP tunnel hardware, -EDEADLK error timing, and DRM device access; all other metrics match the kernel local-privilege pattern.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.0 HIGH
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 09:30 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
7.8 (HIGH)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 05:57 cve.org
HIGH 7.8
CVE Published
Aug 15, 2026 - 05:57 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/i915: clear CRTC color blob pointers after dropping refs

intel_crtc_put_color_blobs() drops the CRTC color blob references, but leaves the corresponding pointers unchanged.

This can matter in intel_crtc_prepare_cleared_state(), which frees the old CRTC hw state before calling intel_dp_tunnel_atomic_clear_stream_bw(). The latter can fail while looking up the DP tunnel group state, for example with -EDEADLK.

If that happens, the function returns without completing the cleared state preparation. The failed atomic state will then be cleared by the atomic core and intel_crtc_free_hw_state() can be called again for the same state, dropping the same blob references again.

Clear the blob pointers after dropping the references so repeated cleanup of the same CRTC hw state is safe.

(cherry picked from commit d5005addb5f68e8a0edce249506757bdc9e3d8c8)

AnalysisAI

Double-free kernel memory corruption in the Linux DRM/i915 Intel graphics driver allows a local low-privileged user to potentially escalate privileges or crash the system. The flaw resides in the CRTC color blob pointer cleanup path: after dropping blob references, the pointers are not nulled, so a subsequent failure in the atomic commit path (e.g., -EDEADLK from DP tunnel state lookup) can trigger a second call to intel_crtc_free_hw_state() on the same already-freed state. No public exploit code exists and EPSS is 0.21%, but the CVSS 7.8 local score reflects the full C/I/A impact if kernel heap corruption is reliably weaponized. Vendor patches are available for stable branches.

Technical ContextAI

The vulnerability is in the Linux kernel's Direct Rendering Manager (DRM) subsystem, specifically the i915 driver for Intel GPUs (cpe:2.3:a:linux:linux). The affected code path involves atomic mode-setting (KMS): intel_crtc_put_color_blobs() decrements reference counts on gamma/degamma/CTM blobs but does not zero the corresponding pointers. In intel_crtc_prepare_cleared_state(), the old CRTC hardware state is freed before intel_dp_tunnel_atomic_clear_stream_bw() is called. If that function returns an error (notably -EDEADLK during DP tunnel group state lookup), the overall atomic transaction fails and the DRM atomic core calls the state cleanup path again, invoking intel_crtc_free_hw_state() a second time on the same CRTC state object. This results in a double-decrement of the blob reference counts, a classic CWE-672 (Use of Resource After Expiration or Release) pattern. Kernel blob objects are reference-counted via drm_property_blob structures; a double-put can cause a use-after-free in kernel heap memory.

RemediationAI

The primary fix is to upgrade to a patched Linux kernel version: 6.12.97 or later for 6.12.x deployments, 6.18.40 or later for 6.18.x deployments, or 7.1.5 or later for 7.x deployments. Patch commits are available via the stable kernel tree at git.kernel.org (see references). Distribution maintainers for Debian, Ubuntu, RHEL, SUSE, and others are expected to backport these fixes into their kernel packages; check your distribution's security advisory channel. If an immediate kernel update is not feasible, a practical compensating control is to restrict access to DRM device nodes (/dev/dri/card*, /dev/dri/renderD*) to only trusted users or service accounts via udev rules or filesystem permissions, reducing the population of users who could trigger the faulty atomic commit path. This has the trade-off of breaking unprivileged GPU access for applications like browsers and media players. Disabling the i915 driver entirely (modprobe.blacklist=i915) eliminates the attack surface but also removes Intel GPU functionality. NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2026-72452.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

EUVD-2026-59351 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy