High 7.8Published May 6, 2026

CVE-2026-43236drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release

Updated under an hour ago (Oct 27, 2026, 8:30 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release The atmel_hlcdc_plane_atomic_duplicate_state() callback was copying the atmel_hlcdc_plane state structure without properly duplicating the drm_plane_state. In particular, state->commit remained set to the old state commit, which can lead to a use-after-free in the next drm_atomic_commit() call. Fix this by calling __drm_atomic_helper_duplicate_plane_state(), which correctly clones the base drm_plane_state (including the ->commit pointer). It has been seen when closing and re-opening the device node while another DRM client (e.g. fbdev) is still attached: ============================================================================= BUG kmalloc-64 (Not tainted): Poison overwritten ----------------------------------------------------------------------------- 0xc611b344-0xc611b344 @offset=836. First byte 0x6a instead of 0x6b FIX kmalloc-64: Restoring Poison 0xc611b344-0xc611b344=0x6b Allocated in drm_atomic_helper_setup_commit+0x1e8/0x7bc age=178 cpu=0 pid=29 drm_atomic_helper_setup_commit+0x1e8/0x7bc drm_atomic_helper_commit+0x3c/0x15c drm_atomic_commit+0xc0/0xf4 drm_framebuffer_remove+0x4cc/0x5a8 drm_mode_rmfb_work_fn+0x6c/0x80 process_one_work+0x12c/0x2cc worker_thread+0x2a8/0x400 kthread+0xc0/0xdc ret_from_fork+0x14/0x28 Freed in drm_atomic_helper_commit_hw_done+0x100/0x150 age=8 cpu=0 pid=169 drm_atomic_helper_commit_hw_done+0x100/0x150 drm_atomic_helper_commit_tail+0x64/0x8c commit_tail+0x168/0x18c drm_atomic_helper_commit+0x138/0x15c drm_atomic_commit+0xc0/0xf4 drm_atomic_helper_set_config+0x84/0xb8 drm_mode_setcrtc+0x32c/0x810 drm_ioctl+0x20c/0x488 sys_ioctl+0x14c/0xc20 ret_fast_syscall+0x0/0x54 Slab 0xef8bc360 objects=21 used=16 fp=0xc611b7c0 flags=0x200(workingset|zone=0) Object 0xc611b340 @offset=832 fp=0xc611b7c0

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 2389fc1305fc1e2cf8b310a75463fefd3058bf48 before fd4a4d0711f48a99b25bcd45e00eef8339eff82d; from 2389fc1305fc1e2cf8b310a75463fefd3058bf48 before 6404898af86d986db1dbbe06177c143e40652e49; 2389fc1305fc1e2cf8b310a75463fefd3058bf48 builds before 796e77c14c4c1e2cd36473760fb6cc66c695eb47; from 2389fc1305fc1e2cf8b310a75463fefd3058bf48 before ac2d898da5095d46bd1ff8585fdd753d58ad91e7; from 2389fc1305fc1e2cf8b310a75463fefd3058bf48 before a205740a7231e967ac77cb731171642901c327af; 2389fc1305fc1e2cf8b310a75463fefd3058bf48 builds before 7b4d0fab3ff2c00c6d34e1952c9df5129a826aee; 2389fc1305fc1e2cf8b310a75463fefd3058bf48 builds before 549c6db503dbb85dbff4840830971853feac6625; from 2389fc1305fc1e2cf8b310a75463fefd3058bf48 before bc847787233277a337788568e90a6ee1557595eb	CNA record
linux linux_kernel linux:linux_kernel	from 4.1 before 5.10.252; from 5.11 before 5.15.202; from 5.16 before 6.1.165; from 6.2 before 6.6.128; from 6.7 before 6.12.75; from 6.13 before 6.18.16; from 6.19 before 6.19.6	NVD

References

References

https://git.kernel.org/stable/c/fd4a4d0711f48a99b25bcd45e00eef8339eff82d	patch
https://git.kernel.org/stable/c/6404898af86d986db1dbbe06177c143e40652e49	patch
https://git.kernel.org/stable/c/796e77c14c4c1e2cd36473760fb6cc66c695eb47	patch
https://git.kernel.org/stable/c/ac2d898da5095d46bd1ff8585fdd753d58ad91e7	patch
https://git.kernel.org/stable/c/a205740a7231e967ac77cb731171642901c327af	patch
https://git.kernel.org/stable/c/7b4d0fab3ff2c00c6d34e1952c9df5129a826aee	patch
https://git.kernel.org/stable/c/549c6db503dbb85dbff4840830971853feac6625	patch
https://git.kernel.org/stable/c/bc847787233277a337788568e90a6ee1557595eb	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.