CVE-2026-72452
Received Received - Intake

Use-After-Free in Linux Kernel DRM/i915 Subsystem

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: drm/i915: clear CRTC color blob pointers after dropping refs intel_crtc_put_color_blobs() drops the CRTC color blob references, but leaves the corresponding pointers unchanged. This can matter in intel_crtc_prepare_cleared_state(), which frees the old CRTC hw state before calling intel_dp_tunnel_atomic_clear_stream_bw(). The latter can fail while looking up the DP tunnel group state, for example with -EDEADLK. If that happens, the function returns without completing the cleared state preparation. The failed atomic state will then be cleared by the atomic core and intel_crtc_free_hw_state() can be called again for the same state, dropping the same blob references again. Clear the blob pointers after dropping the references so repeated cleanup of the same CRTC hw state is safe. (cherry picked from commit d5005addb5f68e8a0edce249506757bdc9e3d8c8)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72452
EUVD
EUVD-2026-59351

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
intel linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper handling of CRTC color blob pointers in the Intel graphics driver. When the function intel_crtc_put_color_blobs() drops references to these blobs, it fails to clear the corresponding pointers. This can lead to issues during state preparation, where cleanup operations may be attempted multiple times, causing potential errors like -EDEADLK.

Detection Guidance

This vulnerability is specific to the Linux kernel's DRM/i915 driver and does not have network-based detection methods. It requires kernel-level inspection. Check if your system is running a vulnerable kernel version by running: uname -a. If the kernel version is affected, look for crashes or errors in kernel logs related to DRM/i915 or atomic state handling.

Impact Analysis

This vulnerability could cause system instability or crashes during graphics operations, particularly when handling display state changes. It may lead to kernel errors or unexpected behavior in applications relying on Intel graphics.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. This resolves the issue by clearing CRTC color blob pointers after dropping references. Monitor kernel logs for DRM/i915 related errors after updating.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72452. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart