cbcvebase.
CVE-2026-23471
published 2026-04-03

CVE-2026-23471: drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug In the Linux kernel, the following vulnerability has been resolved: drm…

medium5.5
drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug In the Linux kernel, the following vulnerability has been resolved: drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug When trying to do a rather aggressive test of igt's "xe_module_load --r reload" with a full desktop environment and game running I noticed a few OOPSes when dereferencing freed pointers, related to framebuffers and property blobs after the compositor exits. Solve this by guarding the freeing in drm_file with drm_dev_enter/exit, and immediately put the references from struct drm_file objects during drm_dev_unplug(). Related warnings for framebuffers on the subtest: [ 739.713076] ------------[ cut here ]------------ WARN_ON(!list_empty(&dev->mode_config.fb_list)) [ 739.713079] WARNING: drivers/gpu/drm/drm_mode_config.c:584 at drm_mode_config_cleanup+0x30b/0x320 [drm], CPU#12: xe_module_load/13145 .... [ 739.713328] Call Trace: [ 739.713330] [ 739.713335] ? intel_pmdemand_destroy_state+0x11/0x20 [xe] [ 739.713574] ? intel_atomic_global_obj_cleanup+0xe4/0x1a0 [xe] [ 739.713794] intel_display_driver_remove_noirq+0x51/0xb0 [xe] [ 739.714041] xe_display_fini_early+0x33/0x50 [xe] [ 739.714284] devm_action_release+0xf/0x20 [ 739.714294] devres_release_all+0xad/0xf0 [ 739.714301] device_unbind_cleanup+0x12/0xa0 [ 739.714305] device_release_driver_internal+0x1b7/0x210 [ 739.714311] device_driver_detach+0x14/0x20 [ 739.714315] unbind_store+0xa6/0xb0 [ 739.714319] drv_attr_store+0x21/0x30 [ 739.714322] sysfs_kf_write+0x48/0x60 [ 739.714328] kernfs_fop_write_iter+0x16b/0x240 [ 739.714333] vfs_write+0x266/0x520 [ 739.714341] ksys_write+0x72/0xe0 [ 739.714345] __x64_sys_write+0x19/0x20 [ 739.714347] x64_sys_call+0xa15/0xa30 [ 739.714355] do_syscall_64+0xd8/0xab0 [ 739.714361] entry_SYSCALL_64_after_hwframe+0x4b/0x53 and [ 739.714459] ------------[ cut here ]------------ [ 739.714461] xe 0000:67:00.0: [drm] drm_WARN_ON(!list_empty(&fb->fi

Affected

9 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.19.10-1 (forky)linux 6.19.10-1 (forky)
linuxlinux
linuxlinux>= bee330f3d67273a68dcb99f59480d59553c008b2 < 54df178324b268c62f847381e2813a1b0f97138454df178324b268c62f847381e2813a1b0f971384
linuxlinux>= bee330f3d67273a68dcb99f59480d59553c008b2 < eec4d5758f33925e0bdb4a32b45d86a68afa4516eec4d5758f33925e0bdb4a32b45d86a68afa4516
linuxlinux>= bee330f3d67273a68dcb99f59480d59553c008b2 < 7e3ec3bf4015156dcc5bafed13f26a587cc37f5c7e3ec3bf4015156dcc5bafed13f26a587cc37f5c
linuxlinux>= bee330f3d67273a68dcb99f59480d59553c008b2 < 074d06d3724ccab0c5bb779db594a82b6405e501074d06d3724ccab0c5bb779db594a82b6405e501
linuxlinux>= bee330f3d67273a68dcb99f59480d59553c008b2 < e493c135980f90c20308d1a98f2e0d1223951e94e493c135980f90c20308d1a98f2e0d1223951e94
linuxlinux>= bee330f3d67273a68dcb99f59480d59553c008b2 < 6bee098b91417654703e17eb5c1822c6dfd0c01d6bee098b91417654703e17eb5c1822c6dfd0c01d
linuxlinux_kernel>= 0 < 6.19.10-16.19.10-1
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.