CVE-2026-43236
Use-After-Free in Linux Kernel DRM atmel-hlcdc Driver
Publication date: 2026-05-06
Last updated on: 2026-05-06
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
| linux_kernel | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a use-after-free issue in the Linux kernel's drm/atmel-hlcdc driver. Specifically, the atmel_hlcdc_plane_atomic_duplicate_state() callback was copying the plane state structure without properly duplicating the drm_plane_state. As a result, the commit pointer in the state structure remained pointing to an old, freed commit, which can lead to a use-after-free error during the next drm_atomic_commit() call.
The problem occurs when closing and reopening the device node while another DRM client, such as fbdev, is still attached. The fix involved correctly cloning the base drm_plane_state, including the commit pointer, by calling __drm_atomic_helper_duplicate_plane_state().
How can this vulnerability impact me? :
This use-after-free vulnerability can lead to memory corruption in the Linux kernel's graphics subsystem. Such corruption may cause system instability, crashes, or potentially allow an attacker to execute arbitrary code with kernel privileges if exploited.
The issue arises when device nodes are closed and reopened while other DRM clients remain attached, which could be triggered by normal user actions or maliciously crafted inputs.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability manifests as a use-after-free error in the Linux kernel's DRM subsystem, specifically related to the atmel_hlcdc driver. Detection can be done by monitoring kernel logs for error messages indicating use-after-free or memory corruption related to drm_atomic_commit or drm_crtc_commit.
You can check the kernel logs using commands such as:
- dmesg | grep -i drm
- journalctl -k | grep -i drm
- grep -i 'use-after-free' /var/log/kern.log
Look for messages similar to "BUG kmalloc-64 (Not tainted): Poison overwritten" or stack traces involving drm_atomic_commit and drm_atomic_helper_commit functions.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability has been fixed by properly duplicating the drm_plane_state in the atmel_hlcdc driver to avoid use-after-free conditions.
Immediate mitigation steps include:
- Update your Linux kernel to a version that includes the fix for this vulnerability.
- Avoid closing and reopening the device node of the atmel_hlcdc DRM device while other DRM clients (such as fbdev) are still attached.
- Monitor kernel logs for related errors and avoid workloads that trigger the vulnerable code path until patched.