CVE-2026-23366
Received Received - Intake
NULL Pointer Dereference in Linux Kernel DRM Client Modeset

Publication date: 2026-03-25

Last updated on: 2026-04-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: drm/client: Do not destroy NULL modes 'modes' in drm_client_modeset_probe may fail to kcalloc. If this occurs, we jump to 'out', calling modes_destroy on it, which dereferences it. This may result in a NULL pointer dereference in the error case. Prevent that.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-25
Last Modified
2026-04-24
Generated
2026-06-16
AI Q&A
2026-03-25
EPSS Evaluated
2026-06-14
NVD
CVE-2026-23366
EUVD
EUVD-2026-15348
Affected Vendors & Products
Showing 10 associated CPEs
Vendor Product Version / Range
linux linux_kernel 6.16
linux linux_kernel From 6.19 (inc) to 6.19.7 (exc)
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel From 6.16.1 (inc) to 6.18.17 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability occurs in the Linux kernel's drm/client component. Specifically, in the drm_client_modeset_probe function, if the allocation of 'modes' using kcalloc fails, the code jumps to an error handling section where it calls modes_destroy on the 'modes' pointer without checking if it is NULL. This leads to a NULL pointer dereference in the error case.

Impact Analysis

The impact of this vulnerability is a potential NULL pointer dereference in the Linux kernel's DRM client code. This can cause a kernel crash or system instability when the error handling code attempts to destroy a NULL 'modes' pointer.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-23366. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart